monitor an eap session in a production environment with a lot of devices
Hi all, I wanted to ask how to monitor an eap session in a production environment with a lot of devices. Have you developed a method or a best practice that helps in those cases? Analyzing freeradius debug, in addition to the state attribute, there is some internal variable to see if a package is part of an ongoing session, it's a retransmitted or duplicated packet, or is it the beginning of a new session? The standard log what does it say about it? many thanks! Marco -- **************************************** Marco Santantonio Direzione Sistemi Informativi, Portale, E-learning Sezione Fonia, VoIP e WiFi www.unito.it ****************************************
Use radmin , the man page shows how you can get log/debug for a single client... That can be used for a single AP etc etc alan On 28 Sep 2017 3:03 pm, "Marco Santantonio" <marco.santantonio@unito.it> wrote:
Hi all,
I wanted to ask how to monitor an eap session in a production environment with a lot of devices. Have you developed a method or a best practice that helps in those cases?
Analyzing freeradius debug, in addition to the state attribute, there is some internal variable to see if a package is part of an ongoing session, it's a retransmitted or duplicated packet, or is it the beginning of a new session?
The standard log what does it say about it?
many thanks!
Marco
-- **************************************** Marco Santantonio Direzione Sistemi Informativi, Portale, E-learning Sezione Fonia, VoIP e WiFi www.unito.it **************************************** - List info/subscribe/unsubscribe? See http://www.freeradius.org/ list/users.html
On Sep 28, 2017, at 10:02 AM, Marco Santantonio <marco.santantonio@unito.it> wrote:
I wanted to ask how to monitor an eap session
What does that mean?
in a production environment with a lot of devices. Have you developed a method or a best practice that helps in those cases?
To do what? Please *describe* what you want to do.
Analyzing freeradius debug, in addition to the state attribute, there is some internal variable to see if a package is part of an ongoing session, it's a retransmitted or duplicated packet, or is it the beginning of a new session?
If the request has a State attribute, it's part of an ongoing authentication session, which is usually EAP. If the request has no State attribute, it's either PAP, or the start of an EAP session. Duplicate requests are *never* processed through the server. Alan DeKok.
ok Alan, i try to explain better... I'm newbie in freeradius. With a lot of debug and test I understand how server works (and I find it great) but i'm struggling to understand and debug problems such as retransmissions, timeouts and similar situations because I can not reproduce them and study them. I've already tested raddebug and now I'll try it with radmin So I would ask if someone had matured some method that could help in this kind of situation... many thank's for your job!!! Marco 2017-09-28 17:36 GMT+02:00 Alan DeKok <aland@deployingradius.com>:
On Sep 28, 2017, at 10:02 AM, Marco Santantonio < marco.santantonio@unito.it> wrote:
I wanted to ask how to monitor an eap session
What does that mean?
in a production environment with a lot of devices. Have you developed a method or a best practice that helps in those cases?
To do what? Please *describe* what you want to do.
Analyzing freeradius debug, in addition to the state attribute, there is some internal variable to see if a package is part of an ongoing session, it's a retransmitted or duplicated packet, or is it the beginning of a new session?
If the request has a State attribute, it's part of an ongoing authentication session, which is usually EAP.
If the request has no State attribute, it's either PAP, or the start of an EAP session.
Duplicate requests are *never* processed through the server.
Alan DeKok.
-- **************************************** Marco Santantonio Direzione Sistemi Informativi, Portale, E-learning Sezione Fonia, VoIP e WiFi www.unito.it ****************************************
wireshark is also very good for this kind of thing too (especially timeouts, retransmits, EAP flows etc) alan On 28 September 2017 at 17:11, Marco Santantonio <marco.santantonio@unito.it> wrote:
ok Alan,
i try to explain better...
I'm newbie in freeradius. With a lot of debug and test I understand how server works (and I find it great) but i'm struggling to understand and debug problems such as retransmissions, timeouts and similar situations because I can not reproduce them and study them.
I've already tested raddebug and now I'll try it with radmin
So I would ask if someone had matured some method that could help in this kind of situation...
many thank's for your job!!!
Marco
2017-09-28 17:36 GMT+02:00 Alan DeKok <aland@deployingradius.com>:
On Sep 28, 2017, at 10:02 AM, Marco Santantonio < marco.santantonio@unito.it> wrote:
I wanted to ask how to monitor an eap session
What does that mean?
in a production environment with a lot of devices. Have you developed a method or a best practice that helps in those cases?
To do what? Please *describe* what you want to do.
Analyzing freeradius debug, in addition to the state attribute, there is some internal variable to see if a package is part of an ongoing session, it's a retransmitted or duplicated packet, or is it the beginning of a new session?
If the request has a State attribute, it's part of an ongoing authentication session, which is usually EAP.
If the request has no State attribute, it's either PAP, or the start of an EAP session.
Duplicate requests are *never* processed through the server.
Alan DeKok.
-- **************************************** Marco Santantonio Direzione Sistemi Informativi, Portale, E-learning Sezione Fonia, VoIP e WiFi www.unito.it **************************************** - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On Sep 28, 2017, at 12:11 PM, Marco Santantonio <marco.santantonio@unito.it> wrote:
I'm newbie in freeradius. With a lot of debug and test I understand how server works (and I find it great) but i'm struggling to understand and debug problems such as retransmissions, timeouts and similar situations because I can not reproduce them and study them.
The only real answer here is to: a) read the RFCs. RFC 5080 for one b) read the FreeRADIUS config files c) read the FreeRADIUS source code. Most of the time, administrators don't need to know how it works. They just need to know that it *does* work. The only time you need to know exactly how all of this works is when you're writing your own RADIUS server. Alan DeKok.
ok, I realize that the question was wrong... I apologize and thank you for your support! Marco 2017-09-28 19:20 GMT+02:00 Alan DeKok <aland@deployingradius.com>:
On Sep 28, 2017, at 12:11 PM, Marco Santantonio < marco.santantonio@unito.it> wrote:
I'm newbie in freeradius. With a lot of debug and test I understand how
server works (and I find it great) but i'm struggling to understand and debug problems such as retransmissions, timeouts and similar situations because I can not reproduce them and study them.
The only real answer here is to:
a) read the RFCs. RFC 5080 for one
b) read the FreeRADIUS config files
c) read the FreeRADIUS source code.
Most of the time, administrators don't need to know how it works. They just need to know that it *does* work.
The only time you need to know exactly how all of this works is when you're writing your own RADIUS server.
Alan DeKok.
-- **************************************** Marco Santantonio Direzione Sistemi Informativi, Portale, E-learning Sezione Fonia, VoIP e WiFi www.unito.it ****************************************
participants (3)
-
Alan Buxey -
Alan DeKok -
Marco Santantonio