I've got a FreeRADIUS server that takes in Accounting data that is proxied to it from another server. In the Accounting packets I see AVPs that are tagged "Unknown-Attribute." I assume that's because either the originating server or the FreeRADIUS server is missing a dictionary file/entry to identify the Attribute. First question: is that assumption correct? If so, who sets that Attribute, the originator or the target? And more generally: as these are written to the MySQL DB I see that they are pulled off the packet and stored as variables that are accessible in the sql.conf file for example: AcctSessionTime = '%{Acct-Session-Time}' Is that variable pulled directly from the packet? So that whatever attribute is in the packet, it will be named %{whatever} ? I've got other data coming in that I need to store in the SQL DB and suppose that I'll need to modify the sql.conf and the radacct table in order to get them in there. Any insights/thoughts/direction would be appreciated. Jeff
Jeffrey Sewell wrote:
I've got a FreeRADIUS server that takes in Accounting data that is proxied to it from another server. In the Accounting packets I see AVPs that are tagged "Unknown-Attribute."
Hm... unknown attributes should be printed as Vendor-123-Attr-456.
I assume that's because either the originating server or the FreeRADIUS server is missing a dictionary file/entry to identify the Attribute.
The proxying server is missing the dictionary entries.
First question: is that assumption correct?
Yes.
If so, who sets that Attribute, the originator or the target?
The originator sets the *number* of the attribute. The proxy uses that number to look up a name in the dictionaries.
And more generally: as these are written to the MySQL DB I see that they are pulled off the packet and stored as variables that are accessible in the sql.conf file for example:
AcctSessionTime = '%{Acct-Session-Time}'
Is that variable pulled directly from the packet? So that whatever attribute is in the packet, it will be named %{whatever} ?
It will look up the name in the dictionary, get the number, and then look up the relevant numbered attribute from the packet.
I've got other data coming in that I need to store in the SQL DB and suppose that I'll need to modify the sql.conf and the radacct table in order to get them in there.
Yes. You may want to take a look at raddb/sites-available/robust-proxy-accounting. It documents a method of proxying transparently when the home server is up, and writing to local disk when it's not. When the home server comes back up, the packets written to disk are forwarded automagically. You may also want to look at raddb/sites-available/buffered-sql for the "write to SQL" portion. Some people have seen significant performance improvements by using this method. i.e. writing all packets directly to SQL can often thrash the SQL server. Alan DeKok
On Aug 29, 2008, at 11:23 PM, Alan DeKok wrote:
Jeffrey Sewell wrote:
I've got a FreeRADIUS server that takes in Accounting data that is proxied to it from another server. In the Accounting packets I see AVPs that are tagged "Unknown-Attribute."
Hm... unknown attributes should be printed as Vendor-123-Attr-456.
I'm going off the raw tcpdump view, maybe they get translated at a higher level. I'll re-check.
I assume that's because either the originating server or the FreeRADIUS server is missing a dictionary file/entry to identify the Attribute.
The proxying server is missing the dictionary entries.
First question: is that assumption correct?
Yes.
Cool, at least I know where to start.
If so, who sets that Attribute, the originator or the target?
The originator sets the *number* of the attribute. The proxy uses that number to look up a name in the dictionaries.
And more generally: as these are written to the MySQL DB I see that they are pulled off the packet and stored as variables that are accessible in the sql.conf file for example:
AcctSessionTime = '%{Acct-Session-Time}'
Is that variable pulled directly from the packet? So that whatever attribute is in the packet, it will be named %{whatever} ?
It will look up the name in the dictionary, get the number, and then look up the relevant numbered attribute from the packet.
So could I pull in any dictionary entry based on number? What's the syntax for that?
I've got other data coming in that I need to store in the SQL DB and suppose that I'll need to modify the sql.conf and the radacct table in order to get them in there.
Yes.
You may want to take a look at raddb/sites-available/robust-proxy-accounting. It documents a method of proxying transparently when the home server is up, and writing to local disk when it's not. When the home server comes back up, the packets written to disk are forwarded automagically.
You may also want to look at raddb/sites-available/buffered-sql for the "write to SQL" portion. Some people have seen significant performance improvements by using this method. i.e. writing all packets directly to SQL can often thrash the SQL server.
Definitely good advice. Thank you!
Alan DeKok - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Jeffrey Sewell wrote:
Hm... unknown attributes should be printed as Vendor-123-Attr-456.
I'm going off the raw tcpdump view, maybe they get translated at a higher level. I'll re-check.
Ah, OK. FreeRADIUS does that translation when it prints the attributes to the detail file. And I'd suggest running wireshark rather than tcpdump. Wireshark has imported the FreeRADIUS dictionaries, and understands a lot more attributes than tcpdump does.
So could I pull in any dictionary entry based on number? What's the syntax for that?
See "man dictionary" and/or the sample dictionary files for the format of the FreeRADIUS dictionary files. Alan DeKok.
So, for example I have a dictionary entry that says this: ATTRIBUTE Acct-Session-Time 46 integer none in single And a wireshark dump that says this: AVP: 1=15 t=Unknown(24757) t=Unknown-Attribute(46): 0000000200003 In the sql.conf file I have this: AcctSessionTime = '%{Acct-Session-Time}', \ However, attribute 46 is definitely not the Account Session time and the AcctSessionTime entries in the db are things like 10421 (which they should be). So how do I get the value of that "Unknown-Attribute" into a column in the db? I'm probably missing something obvious, but can't see it. On Sep 2, 2008, at 4:37 PM, Alan DeKok wrote:
Jeffrey Sewell wrote:
Hm... unknown attributes should be printed as Vendor-123-Attr-456.
I'm going off the raw tcpdump view, maybe they get translated at a higher level. I'll re-check.
Ah, OK. FreeRADIUS does that translation when it prints the attributes to the detail file.
And I'd suggest running wireshark rather than tcpdump. Wireshark has imported the FreeRADIUS dictionaries, and understands a lot more attributes than tcpdump does.
So could I pull in any dictionary entry based on number? What's the syntax for that?
See "man dictionary" and/or the sample dictionary files for the format of the FreeRADIUS dictionary files.
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Jeffrey Sewell wrote:
So, for example I have a dictionary entry that says this:
ATTRIBUTE Acct-Session-Time 46 integer none in single
? That's not a FreeRADIUS dictionary file. The "none in single" portion is... not what we use.
And a wireshark dump that says this:
AVP: 1=15 t=Unknown(24757) t=Unknown-Attribute(46): 0000000200003
Ah. WiMAX BS-Id.
So how do I get the value of that "Unknown-Attribute" into a column in the db?
Grab the latest code from git.freeradius.org. Or wait a day or so for 2.1.1. It has native support for decoding WiMAX attributes. It includes a WiMAX dictionary. And lots more.
I'm probably missing something obvious, but can't see it.
I feel bad, but "upgrade" is too often the answer to problems on this list. It's not that previous versions are so bad, it's that the pace of development is too fast. Alan DeKok.
That was the solution: 2.1.0. The dictionary was the culprit. I can't seem to find the 2.1 equivalent of the place in the old radius.conf file where I tell it to log Accounting records to the SQL db. I'm sure it'll seem obvious once I find it... On Sep 17, 2008, at 12:20 PM, Alan DeKok wrote:
Jeffrey Sewell wrote:
So, for example I have a dictionary entry that says this:
ATTRIBUTE Acct-Session-Time 46 integer none in single
? That's not a FreeRADIUS dictionary file. The "none in single" portion is... not what we use.
And a wireshark dump that says this:
AVP: 1=15 t=Unknown(24757) t=Unknown-Attribute(46): 0000000200003
Ah. WiMAX BS-Id.
So how do I get the value of that "Unknown-Attribute" into a column in the db?
Grab the latest code from git.freeradius.org. Or wait a day or so for 2.1.1. It has native support for decoding WiMAX attributes. It includes a WiMAX dictionary. And lots more.
I'm probably missing something obvious, but can't see it.
I feel bad, but "upgrade" is too often the answer to problems on this list. It's not that previous versions are so bad, it's that the pace of development is too fast.
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Jeffrey Sewell wrote:
That was the solution: 2.1.0. The dictionary was the culprit.
I can't seem to find the 2.1 equivalent of the place in the old radius.conf file where I tell it to log Accounting records to the SQL db. I'm sure it'll seem obvious once I find it...
raddb/sites-available/default There should be a symlink to it from raddb/sites-enabled/default. There's a *lot* of sample configurations in raddb/sites-available, for a lot of different possible configurations. Alan DeKok.
Found it! Thanks. That's quite extensive, I'll have to spend some quality time with this new version. Well done! On Sep 17, 2008, at 10:47 PM, Alan DeKok wrote:
Jeffrey Sewell wrote:
That was the solution: 2.1.0. The dictionary was the culprit.
I can't seem to find the 2.1 equivalent of the place in the old radius.conf file where I tell it to log Accounting records to the SQL db. I'm sure it'll seem obvious once I find it...
raddb/sites-available/default
There should be a symlink to it from raddb/sites-enabled/default.
There's a *lot* of sample configurations in raddb/sites-available, for a lot of different possible configurations.
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
participants (2)
-
Alan DeKok -
Jeffrey Sewell