Cause of relatively large retransmission-rate in radsniff output

Fekete Tamás fektom at
Tue Feb 12 11:17:43 CET 2019


I would like to ask help with understanding my radsniff output as usually I
get a huge number of Access-Request retransmission rate.

When I have run radsniff -W 1, I got the following output:


Access-Request counters:
        Total     : 66.000/s
        Linked    : 64.000/s
        Unlinked  : 0.000/s
Access-Request latency:
        High      : 1000.607ms
        Low       : 0.260ms
        Average   : 17.473ms
        MA        : 23.723ms
Access-Request retransmits & loss:
        RT (0)    : 56.000/s


As it can be seen above, I got 56 retransmission.

It is a huge number compared to the 66 Total Access Request / sec.

I checked if the RT (retransmission) value contains the loss packets and
the Access-Requests which has been resent due to Access-Challenges.
My result is that loss packets are separately show up in this statistics

Access-Request retransmits & loss:
        Lost      : 1.000/s
        RT (0)    : 55.000/s

And Access-Requests followed by Access-Challenges are not count into the
Retrasmission. Here is an output from a virtual machine which was tested
with eapol_test (with peap-mschapv2 method):
Interface capture rate:
        ens3      : 0.000/s
        lo        : 40.000/s
Access-Request counters:
        Total     : 10.000/s
        Linked    : 10.000/s
        Unlinked  : 0.000/s
Access-Request latency:
        High      : 6.417ms
        Low       : 0.119ms
        Average   : 0.949ms
        MA        : 0.949ms
Access-Accept counters:
        Total     : 1.000/s
        Linked    : 1.000/s
        Unlinked  : 0.000/s
Access-Accept latency:
        High      : 0.190ms
        Low       : 0.190ms
        Average   : 0.190ms
        MA        : 0.190ms
Access-Challenge counters:
        Total     : 9.000/s
        Linked    : 9.000/s
        Unlinked  : 0.000/s
Access-Challenge latency:
        High      : 6.417ms
        Low       : 0.119ms
        Average   : 1.033ms
        MA        : 1.033ms

It means that the Access-Requests followed by Access-Challenges are not
evaluated like Retransmitted requests. They are counted like new

So my question is, do you think this retransmission rate is normal?

And if not or not sure, do you have a hint or suggestion where to start the
If I should use debug output of Freeradius, what is the thing I have to
look in it?

- Tamas Fekete

More information about the Freeradius-Users mailing list