Hi, Since lighting up IPv6 on our FreeRADIUS infrastructure, I have noticed behaviour that seems to result in the following logic kicking off: ---- authorize { ... update request { NAS-IPv6-Address = Packet-Src-IPv6-Address NAS-IP-Address = Packet-Src-IP-Address } ... } ----- So, when NAS-IP(v6)-Address already exists, nothing happens, however if it does, then it an attribute with the contents of Packet-Src-IP(v6)-Address is added; obviously depending on the socket type the packet arrives over so I am guessing in practice you probably really only see this when communicating with IPv6 proxies? The problem is, I have not added this type of thing to my config. Checking the raw packet captures show that the client is not setting NAS-IPv6-Address but by the time I sql log it in post-auth, it's there, set to Packet-Src-IPv6-Address :-/ Idea's and suggestions would be much obliged, comments regarding my use of NAS-(IP(v6)?-Address|Identifier) to /dev/null though, unless you have a better suggestion? ;) Cheers ---- dot1x related virtual servers ---- listen { type = auth port = 1812 ipv6addr = :: clients = dot1x } listen { type = auth port = 1812 ipaddr = * clients = dot1x } listen { type = acct port = 1813 ipv6addr = :: clients = dot1x } listen { type = acct port = 1813 ipaddr = * clients = dot1x } server lanwarden { .... } server eduroam { authorize { preprocess testers # braindead JANET PAP test hook if ((Hint) && Hint == test && !(EAP-Message)) { update control { Proxy-To-Realm := "auth.virtual" } handled } if (!(Hint) || Hint != test) { # detail.eduroam attr_filter.eduroam-auth } rewrite.called_station_id rewrite.calling_station_id client-info # let people know *which* box did the auth update reply { NAS-Identifier := "%{config:local.MY.hostname}" NAS-IP-Address := "%{config:local.MY.addr.v4}" NAS-IPv6-Address := "%{config:local.MY.addr.v6}" } # Reject EAP-less authentications if (!(EAP-Message)) { update reply { Reply-Message := "We only accept EAP requests" } reject } # Reject Calling-Station-Id-less authentications if (!(Calling-Station-Id)) { update reply { Reply-Message := "No Calling-Station-Id" } reject } if (!(User-Name)) { update reply { Reply-Message := "No User-Name" } reject } validate_username suffix # Reject realm's authentications that are not for us early if (Realm != "%{config:local.MY.realm}") { update reply { Reply-Message := "Not @%{config:local.MY.realm} User-Name" } reject } EAP { ok = return } ldap-lanwarden if (ok) { if (control:LanWarden-Host-State != "enable") { update reply { Reply-Message := "LW: disabled" } reject } # if ((EAP-Message)) { # cache_ldap-userdn # } } Autz-Type Status-Server { ok } } authenticate { Auth-Type EAP { EAP } } post-auth { Post-Auth-Type Reject { sql.dot1x attr_filter.access_reject eap-has-no-reply-message # detail.eduroam } # if ((EAP-Message) && !(Ldap-UserDn)) { # cache_ldap-userdn # } if (!(Hint) || Hint != test) { sql.dot1x } update reply { User-Name !* ANY } attr_filter.eduroam-auth eap-has-no-reply-message # if (!(Hint) || Hint != test) { # detail.eduroam # } } preacct { preprocess suffix } accounting { # detail.eduroam attr_filter.eduroam-acct rewrite.called_station_id rewrite.calling_station_id # Reject Calling-Station-Id-less authentications if (!(Calling-Station-Id)) { update reply { Reply-Message := "No Calling-Station-Id" } reject } if (!(User-Name)) { update reply { Reply-Message := "No User-Name" } reject } validate_username # Reject realm's authentications that are not for us early if (Realm != "%{config:local.MY.realm}") { update reply { Reply-Message := "Not @%{config:local.MY.realm} User-Name" } reject } detail.dot1x.acct } session { ok } } --------------------- ---- policy.conf ---- policy { mac-addr = ([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2}) rewrite.called_station_id { if((Called-Station-Id) && "%{Called-Station-Id}" =~ /^%{config:policy.mac-addr}(:(.+))?$/i) { update request { Called-Station-Id := "%{tolower:%{1}-%{2}-%{3}-%{4}-%{5}-%{6}}" } # SSID componment? if ("%{7}") { update request { Called-Station-Id := "%{request:Called-Station-Id}%{7}" } } updated } else { noop } } rewrite.calling_station_id { if((Calling-Station-Id) && "%{Calling-Station-Id}" =~ /^%{config:policy.mac-addr}$/i) { update request { Calling-Station-Id := "%{tolower:%{1}-%{2}-%{3}-%{4}-%{5}-%{6}}" } update control { Local-MAC-Address := "%{tolower:%{1}%{2}%{3}%{4}%{5}%{6}}" } updated } else { noop } } rewrite.quirk.wlc { if (NAS-IP-Address == 172.16.3.124 && NAS-Identifier == "wlc-01") { switch "%{Airespace-Wlan-Id}" { case "1" { update request { NAS-Port-Id := "eduroam" } } case "5" { update request { NAS-Port-Id := "UTILICOM" } } case "6" { update request { NAS-Port-Id := "BTOpenzone" } } case "7" { update request { NAS-Port-Id := "soas-wpa-psk" } } case { update request { NAS-Port-Id := "UNKNOWN" } } } if (Packet-Type == "Accounting-Request") { update request { NAS-Port-Type := "Wireless-802.11" Called-Station-Id := "%{Called-Station-Id}:%{NAS-Port-Id}" } switch "%{Tunnel-Private-Group-Id}" { case "140" { update request { Tunnel-Private-Group-Id := "btopenzone" } } case "128" { update request { Tunnel-Private-Group-Id := "eduroam" } } case "127" { update request { Tunnel-Private-Group-Id := "unauthorised" } } case "72" { update request { Tunnel-Private-Group-Id := "users-unmanaged" } } case "153" { update request { Tunnel-Private-Group-Id := "utilicom" } } case { update request { Tunnel-Private-Group-Id := "UNKNOWN" } } } } updated } else { noop } } validate_username { if (User-Name !~ /@/ && User-Name =~ /^[[:graph:]]+$/) { ok } elsif (User-Name !~ /@.*@/ && User-Name =~ /^[[:graph:]]*@[[:alnum:]-]+(\\.[[:alnum:]-]+)+$/) { ok } else { update reply { Reply-Message := "Invalid User-Name Syntax" } reject } } ldap-login { redundant-load-balance { ldap_login1 { $template ldap-failover } ldap_login2 { $template ldap-failover } } } ldap-lanwarden { redundant-load-balance { ldap_lanwarden1 { $template ldap-failover } ldap_lanwarden2 { $template ldap-failover } } } # RFC compliance eap-has-no-reply-message { if ((reply:EAP-Message)) { update reply { Reply-Message !* ANY } } } mac_auth { if (Realm == NULL && !(EAP-Message) && NAS-Port-Type == Ethernet \ && Service-Type == Call-Check \ && User-Name == "%{User-Password}" \ && User-Name =~ /^[0-9a-f]{12}$/i \ && Calling-Station-Id =~ /^([0-9a-f]{2})-([0-9a-f]{2})-([0-9a-f]{2})-([0-9a-f]{2})-([0-9a-f]{2})-([0-9a-f]{2})$/i \ && User-Name =~ /^%{1}%{2}%{3}%{4}%{5}%{6}$/i) { ok } else { noop } } lanwarden_vlan1 { update control { Tunnel-Private-Group-Id := "%{ldap_lanwarden1:ldap:///ou=Networks,ou=LanWarden,o=soas?cn?one?(&(objectClass=lanwardenNetwork)(member=%{control:Ldap-UserDn}))}" } if ((control:Tunnel-Private-Group-Id)) { ok } else { fail } } lanwarden_vlan2 { update control { Tunnel-Private-Group-Id := "%{ldap_lanwarden2:ldap:///ou=Networks,ou=LanWarden,o=soas?cn?one?(&(objectClass=lanwardenNetwork)(member=%{control:Ldap-UserDn}))}" } if ((control:Tunnel-Private-Group-Id)) { ok } else { fail } } lanwarden_vlan { if ((control:Ldap-UserDn)) { redundant-load-balance { lanwarden_vlan1 lanwarden_vlan2 } if (ok && control:Tunnel-Private-Group-Id != "") { update reply { Tunnel-Private-Group-Id := "%{control:Tunnel-Private-Group-Id}" } } else { noop } } else { noop } } client-info { if ((client:shortname)) { update request { NAS-Identifier := "%{client:shortname}" } } if ((client:vendor)) { update request { Huntgroup-Name := "%{client:vendor}" } } } testers { if ((User-Name == "testauth@soas.ac.uk" \ && NAS-IP-Address == 193.60.199.62 \ && NAS-Port == 1812) \ || (Connect-Info == "JANET Roaming test" \ && NAS-IP-Address == 127.0.0.1 \ && Calling-Station-Id == "02-00-00-00-00-01" \ && NAS-Port-Type == Wireless-802.11)) { update request { Hint := test Cleartext-Password := "%{config:local.test.password}" } } } } --------------------- ----- debug -X ------ rad_recv: Access-Request packet from host 2001:630:1:129::249 port 63536, id=88, length=212 User-Name = "foobar@soas.ac.uk" NAS-IP-Address = 10.6.0.12 NAS-Port = 2 NAS-Identifier = "10.6.0.11" NAS-Port-Type = Wireless-802.11 Calling-Station-Id = "001122334455" Called-Station-Id = "554433221100" Service-Type = Login-User Framed-MTU = 1100 EAP-Message = 0x020900061500 State = 0xd53f4a5ed2365f22247722c7299e5713 Vendor-14823-Attr-5 = 0x656475726f616d Vendor-14823-Attr-6 = 0x426564666f7264537175617265415033 Message-Authenticator = 0x26f56bb65ab36c9e1e997b7abd6ff3a9 Proxy-State = 0x4f53432d457874656e6465642d49643d363030 server eduroam { # Executing section authorize from file /etc/freeradius/sites-enabled/dot1x +- entering group authorize {...} ++[preprocess] returns ok ++- entering policy testers {...} +++? if ((User-Name == "testauth@soas.ac.uk" && NAS-IP-Address == 193.60.199.62 && NAS-Port == 1812) || (Connect-Info == "JANET Roaming test" && NAS-IP-Address == 127.0.0.1 && Calling-Station-Id == "02-00-00-00-00-01" && NAS-Port-Type == Wireless-802.11)) ?? Evaluating (User-Name == "testauth@soas.ac.uk" ) -> FALSE ?? Skipping (NAS-IP-Address == 193.60.199.62 ) ?? Skipping (NAS-Port == 1812) (Attribute Connect-Info was not found) ?? Evaluating (Connect-Info == "JANET Roaming test" ) -> FALSE ?? Skipping (NAS-IP-Address == 127.0.0.1 ) ?? Skipping (Calling-Station-Id == "02-00-00-00-00-01" ) ?? Skipping (NAS-Port-Type == Wireless-802.11) +++? if ((User-Name == "testauth@soas.ac.uk" && NAS-IP-Address == 193.60.199.62 && NAS-Port == 1812) || (Connect-Info == "JANET Roaming test" && NAS-IP-Address == 127.0.0.1 && Calling-Station-Id == "02-00-00-00-00-01" && NAS-Port-Type == Wireless-802.11)) -> FALSE ++- policy testers returns ok ++? if ((Hint) && Hint == test && !(EAP-Message)) ?? Evaluating (Hint) -> FALSE ? Skipping (Hint == test ) ?? Skipping (EAP-Message) ++? if ((Hint) && Hint == test && !(EAP-Message)) -> FALSE ++? if (!(Hint) || Hint != test) ?? Evaluating (Hint) -> FALSE ? Converting !FALSE -> TRUE ? Skipping (Hint != test) ++? if (!(Hint) || Hint != test) -> TRUE ++- entering if (!(Hint) || Hint != test) {...} [attr_filter.eduroam-auth] expand: %{Realm} -> +++[attr_filter.eduroam-auth] returns noop ++- if (!(Hint) || Hint != test) returns noop ++- entering policy rewrite.called_station_id {...} +++? if ((Called-Station-Id) && "%{Called-Station-Id}" =~ /^%{config:policy.mac-addr}(:(.+))?$/i) ?? Evaluating (Called-Station-Id) -> TRUE expand: %{Called-Station-Id} -> 554433221100 expand: policy.mac-addr -> policy.mac-addr expand: ^%{config:policy.mac-addr}(:(.+))?$ -> ^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})(:(.+))?$ ? Evaluating ("%{Called-Station-Id}" =~ /^%{config:policy.mac-addr}(:(.+))?$/i) -> TRUE +++? if ((Called-Station-Id) && "%{Called-Station-Id}" =~ /^%{config:policy.mac-addr}(:(.+))?$/i) -> TRUE +++- entering if ((Called-Station-Id) && "%{Called-Station-Id}" =~ /^%{config:policy.mac-addr}(:(.+))?$/i) {...} expand: %{1}-%{2}-%{3}-%{4}-%{5}-%{6} -> 55-44-33-22-11-00 expand: %{tolower:%{1}-%{2}-%{3}-%{4}-%{5}-%{6}} -> 55-44-33-22-11-00 ++++[request] returns noop ++++? if ("%{7}") expand: %{7} -> ? Evaluating ("%{7}") -> FALSE ++++? if ("%{7}") -> FALSE ++++[updated] returns updated +++- if ((Called-Station-Id) && "%{Called-Station-Id}" =~ /^%{config:policy.mac-addr}(:(.+))?$/i) returns updated +++ ... skipping else for request 105: Preceding "if" was taken ++- policy rewrite.called_station_id returns updated ++- entering policy rewrite.calling_station_id {...} +++? if ((Calling-Station-Id) && "%{Calling-Station-Id}" =~ /^%{config:policy.mac-addr}$/i) ?? Evaluating (Calling-Station-Id) -> TRUE expand: %{Calling-Station-Id} -> 001122334455 expand: policy.mac-addr -> policy.mac-addr expand: ^%{config:policy.mac-addr}$ -> ^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$ ? Evaluating ("%{Calling-Station-Id}" =~ /^%{config:policy.mac-addr}$/i) -> TRUE +++? if ((Calling-Station-Id) && "%{Calling-Station-Id}" =~ /^%{config:policy.mac-addr}$/i) -> TRUE +++- entering if ((Calling-Station-Id) && "%{Calling-Station-Id}" =~ /^%{config:policy.mac-addr}$/i) {...} expand: %{1}-%{2}-%{3}-%{4}-%{5}-%{6} -> 00-11-22-33-44-55 expand: %{tolower:%{1}-%{2}-%{3}-%{4}-%{5}-%{6}} -> 00-11-22-33-44-55 ++++[request] returns updated expand: %{1}%{2}%{3}%{4}%{5}%{6} -> 001122334455 expand: %{tolower:%{1}%{2}%{3}%{4}%{5}%{6}} -> 001122334455 ++++[control] returns updated ++++[updated] returns updated +++- if ((Calling-Station-Id) && "%{Calling-Station-Id}" =~ /^%{config:policy.mac-addr}$/i) returns updated +++ ... skipping else for request 105: Preceding "if" was taken ++- policy rewrite.calling_station_id returns updated ++- entering policy client-info {...} +++? if ((client:shortname)) ?? Evaluating (client:shortname) -> TRUE +++? if ((client:shortname)) -> TRUE +++- entering if ((client:shortname)) {...} expand: %{client:shortname} -> jrs.2.v6 ++++[request] returns updated +++- if ((client:shortname)) returns updated +++? if ((client:vendor)) ?? Evaluating (client:vendor) -> TRUE +++? if ((client:vendor)) -> TRUE +++- entering if ((client:vendor)) {...} expand: %{client:vendor} -> ++++[request] returns updated +++- if ((client:vendor)) returns updated ++- policy client-info returns updated expand: local.MY.hostname -> local.MY.hostname expand: %{config:local.MY.hostname} -> chlorine.it.soas.ac.uk expand: local.MY.addr.v4 -> local.MY.addr.v4 expand: %{config:local.MY.addr.v4} -> 212.219.238.70 expand: local.MY.addr.v6 -> local.MY.addr.v6 expand: %{config:local.MY.addr.v6} -> 2001:630:1b:6003:90c0:802a:d873:c284 ++[reply] returns updated ++? if (!(EAP-Message)) ?? Evaluating (EAP-Message) -> TRUE ? Converting !TRUE -> FALSE ++? if (!(EAP-Message)) -> FALSE ++? if (!(Calling-Station-Id)) ?? Evaluating (Calling-Station-Id) -> TRUE ? Converting !TRUE -> FALSE ++? if (!(Calling-Station-Id)) -> FALSE ++? if (!(User-Name)) ?? Evaluating (User-Name) -> TRUE ? Converting !TRUE -> FALSE ++? if (!(User-Name)) -> FALSE ++- entering policy validate_username {...} +++? if (User-Name !~ /@/ && User-Name =~ /^[[:graph:]]+$/) ? Evaluating (User-Name !~ /@/) -> FALSE ? Skipping (User-Name =~ /^[[:graph:]]+$/) +++? if (User-Name !~ /@/ && User-Name =~ /^[[:graph:]]+$/) -> FALSE +++? elsif (User-Name !~ /@.*@/ && User-Name =~ /^[[:graph:]]*@[[:alnum:]-]+(\\.[[:alnum:]-]+)+$/) ? Evaluating (User-Name !~ /@.*@/) -> TRUE ? Evaluating (User-Name =~ /^[[:graph:]]*@[[:alnum:]-]+(\\.[[:alnum:]-]+)+$/) -> TRUE +++? elsif (User-Name !~ /@.*@/ && User-Name =~ /^[[:graph:]]*@[[:alnum:]-]+(\\.[[:alnum:]-]+)+$/) -> TRUE +++- entering elsif (User-Name !~ /@.*@/ && User-Name =~ /^[[:graph:]]*@[[:alnum:]-]+(\\.[[:alnum:]-]+)+$/) {...} ++++[ok] returns ok +++- elsif (User-Name !~ /@.*@/ && User-Name =~ /^[[:graph:]]*@[[:alnum:]-]+(\\.[[:alnum:]-]+)+$/) returns ok +++ ... skipping else for request 105: Preceding "if" was taken ++- policy validate_username returns ok [suffix] Looking up realm "soas.ac.uk" for User-Name = "foobar@soas.ac.uk" [suffix] Found realm "soas.ac.uk" [suffix] Adding Stripped-User-Name = "foobar" [suffix] Adding Realm = "soas.ac.uk" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok ++? if (Realm != "%{config:local.MY.realm}") expand: local.MY.realm -> local.MY.realm expand: %{config:local.MY.realm} -> soas.ac.uk ? Evaluating (Realm != "%{config:local.MY.realm}") -> FALSE ++? if (Realm != "%{config:local.MY.realm}") -> FALSE [EAP] EAP packet type response id 9 length 6 [EAP] Continuing tunnel setup. ++[EAP] returns ok Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/dot1x +- entering group EAP {...} [EAP] Request found, released from the list [EAP] EAP/ttls [EAP] processing type ttls [ttls] Authenticate [ttls] processing EAP-TLS [ttls] Received TLS ACK [ttls] ACK handshake is finished [ttls] eaptls_verify returned 3 [ttls] eaptls_process returned 3 [ttls] Using saved attributes from the original Access-Accept User-Name = "foobar@soas.ac.uk" Auth-Type = MSCHAP [ttls] Saving response in the cache [EAP] Freeing handler ++[EAP] returns ok # Executing section post-auth from file /etc/freeradius/sites-enabled/dot1x +- entering group post-auth {...} ++? if (!(Hint) || Hint != test) ?? Evaluating (Hint) -> FALSE ? Converting !FALSE -> TRUE ? Skipping (Hint != test) ++? if (!(Hint) || Hint != test) -> TRUE ++- entering if (!(Hint) || Hint != test) {...} [sql.dot1x] expand: %{reply:User-Name} -> foobar@soas.ac.uk [sql.dot1x] expand: %{%{reply:User-Name}:-%{request:User-Name}} -> foobar@soas.ac.uk [sql.dot1x] sql_set_user escaped user --> 'foobar@soas.ac.uk' [sql.dot1x] expand: %{request:Packet-Src-IPv6-Address} -> 2001:630:1:129::249 [sql.dot1x] expand: %{NAS-Port} -> 2 [sql.dot1x] expand: %{reply:Auth-Type} -> MSCHAP [sql.dot1x] expand: INSERT INTO dot1x_auth ( timestamp, packet_src_address, user_name, realm, operator_name, nas_ip_address, nas_ipv6_address, nas_identifier, nas_port, nas_port_type, nas_port_id, called_station_id, calling_station_id, packet_type, eap_type, auth_type, tunnel_private_group_id, reply_message ) VALUES ( '%S'::timestamp, '%{%{request:Packet-Src-IPv6-Address}:-%{request:Packet-Src-IP-Address}}', '%{SQL-User-Name}', '%{request:Realm}', NULLIF('%{request:Operator-Name}', ''), NULLIF('%{request:NAS-IP-Address}', '')::inet, NULLIF('%{request:NAS-IPv6-Address}', '')::inet, '%{request:NAS-Identifier}', %{%{NAS-Port}:-NULL}::integer, '%{request:NAS-Port-Type}', NULLIF('%{request:NAS-Port-Id}',''), lower('%{request:Called-Station-Id}'), lower('%{request:Calling-Station-Id}'), '%{reply:Packet-Type}', '%{EAP-Type}', '%{%{reply:Auth-Type}:-%{control:Auth-Type}}', '%{reply:Tunnel-Private-Group-Id}', '%{reply:Reply-Message}' ) -> INSERT INTO! dot1x_auth ( timestamp, packet rlm_sql (sql.dot1x) in sql_postauth: query is INSERT INTO dot1x_auth ( timestamp, packet_src_address, user_name, realm, operator_name, nas_ip_address, nas_ipv6_address, nas_identifier, nas_port, nas_port_type, nas_port_id, called_station_id, calling_station_id, packet_type, eap_type, auth_type, tunnel_private_group_id, reply_message ) VALUES ( '2010-12-13 19:58:37'::timestamp, '2001:630:1:129::249', 'foobar@soas.ac.uk', 'soas.ac.uk', NULLIF('', ''), NULLIF('10.6.0.12', '')::inet, NULLIF('2001:630:1:129::249', '')::inet, 'jrs.2.v6', 2::integer, 'Wireless-802.11', NULLIF('',''), lower('55-44-33-22-11-00'), lower('00-11-22-33-44-55'), 'Access-Accept', 'EAP-TTLS', 'MSCHAP', '', '' ) rlm_sql (sql.dot1x): Reserving sql socket id: 4 rlm_sql_postgresql: Status: PGRES_COMMAND_OK rlm_sql_postgresql: query affected rows = 1 rlm_sql (sql.dot1x): Released sql socket id: 4 +++[sql.dot1x] returns ok ++- if (!(Hint) || Hint != test) returns ok ++[reply] returns ok [attr_filter.eduroam-auth] expand: %{Realm} -> soas.ac.uk attr_filter: Matched entry DEFAULT at line 1 ++[attr_filter.eduroam-auth] returns updated ++- entering policy eap-has-no-reply-message {...} +++? if ((reply:EAP-Message)) ?? Evaluating (reply:EAP-Message) -> TRUE +++? if ((reply:EAP-Message)) -> TRUE +++- entering if ((reply:EAP-Message)) {...} ++++[reply] returns updated +++- if ((reply:EAP-Message)) returns updated ++- policy eap-has-no-reply-message returns updated } # server eduroam Sending Access-Accept of id 88 to 2001:630:1:129::249 port 63536 NAS-IP-Address = 212.219.238.70 NAS-IPv6-Address = 2001:630:1b:6003:90c0:802a:d873:c284 MS-MPPE-Recv-Key = 0xfc5dc29f224e5ee815ece548d5df7442e12427c0b0bb8a8dc12ad8c16aeef0e8 MS-MPPE-Send-Key = 0xd092db1e188db46ba35491c99a7f0f9634b3de43e992a4fa3b56f64e75a3eaa1 EAP-Message = 0x03090004 Message-Authenticator = 0x00000000000000000000000000000000 Proxy-State = 0x4f53432d457874656e6465642d49643d363030 Finished request 105. Going to the next request --------------------- -- Alexander Clouter .sigmonster says: Bo Derek ruined my life!