Conflicting packets

[Alan DeKok]

rihad wrote:
> We have FreeRADIUS 2.1.3 servicing four Cisco NASses, which in turn
> service hundreds of PPPoE clients. rlm_perl with a custom written script
> is used for authorization/accounting, performing at about 10 auth
> requests/sec on a Dell PowerEdge 2950 box.

  That is *incredibly* slow.  The server should normally be able to
handle 1000's of requests/s going to a DB, and 10's of 1000's of
requests/s if the user data is cached in RAM.

> At times, when a NAS is
> rebooted, triggering reauthentication of hundreds of PPPoE users, the
> server log is swamped with many lines of this kind:
> 
> Error: Received conflicting packet from client 10.10.70.3 port 1645 -
> ID: 86 due to unfinished request 273963.  Giving up on old request.

  Yup.  Your system is too slow to handle the load.

> I've tried all sorts of combinations for the above, with max_requests as
> low as 50, to no avail.

  There is no magic configuration option that will make your server faster.

  Do the math: 100's of users dialing in simultaneously, with the server
processing 10 packets/s.  With a backlog of 500 requests, it will be
many 10s of seconds before the server gets around to processing a
particular request.  At that point, the ADSL modem NAS will have given
up, and tried *again*.  This will increase the backlog, likely doubling it.

  However, if you want to "work around" the problem, set "max_requests"
to something like 128000.  The server will use more RAM, but it will
make progress.

> Can freeradius be configured to reply with a (temporary) REJECT to an
> auth request when max_requests is reached, instead of just ignoring the
> request?

  No.

> I think that would allow the server to make steady progress.

  No.  It means that the users will think that they can't get on, and
will call tech support for help.

> What else should I do in terms of radius configuration? Please do not
> suggest that I fix the code to make it faster, it's more of a
> misconfiguration issue (radius or Cisco).

  Nonsense.  Your code is slow.  Don't blame FreeRADIUS or Cisco for
your mistake.

> The server should be making
> some progress no matter how slow it ran, unlike what we're having at the
> times of trouble.

  The server *is* making progress.  It just doesn't matter.  When the
CPU is pegged at 100% due to YOUR SCRIPT BEING SLOW, then no amount of
magic RADIUS configuration will make the system run faster.

  Fix your script, or install 4x as many servers, and put a load
balancer in front of them.  Nothing else will make the system run faster.

  Alan DeKok.