[EXTERNAL] NSAPI changes Acct-Session-Id from upstream provider

[Winfield, Alister (Senior Solutions Architect)]

Just in case, I have seen at least one instance where there is an Acct-Multi-Session-Id that is stable, and Acct-Session-Id is not.



Worth a check, you never know given how many manufacturers coders seem to have limited ability to read a standard and implement what it says.

--
A.Winfield.

From: Freeradius-Users <freeradius-users-bounces+alister.winfield=sky.uk at lists.freeradius.org> on behalf of Gabriel Marais <gabriel.j.marais at gmail.com>
Date: Monday, 24 February 2025 at 07:06
To: FreeRadius users mailing list <freeradius-users at lists.freeradius.org>
Subject: [EXTERNAL] NSAPI changes Acct-Session-Id from upstream provider
Hi Guys

This might be off topic but I was wondering if someone with more
knowledge than me, would be able to confirm the following :-

In a mobile network scenario with thousands of IoT devices

On our radius servers, we've been noticing a lot of 0-byte sessions on
our databases and upon investigation, we've seen the following
behaviour :-

> Authentication Request Received
< Access Accept sent back
> Accounting Start Packet Received with a Acct-Session-Id
< Acknowledgement sent back
> Interim Accounting Packet Received - This time with a different Acct-Session-Id for the same connection

** At this point, things start going bad as we are not able to update
the original DB entry created with the Acct Start Packet, since the
Acct-Session-Id differs between the packet received in the Accounting
Start Packet and the Interim Accounting Packet.

This results in a 0-session entry in the DB for the Accounting Start
Packet entry as a new entry is written into the DB based on the new
Acct-Session-Id received in the Interim Accounting packet.

Any subsequent packets received with a different Acct-Session-Id,
results in writing a new DB entry when the Interim Accounting Packet
is received.

We queried this with the upstream provider, and they advised that the
3GPP-NSAPI number changes when packets are received and they claim
that the Acct-Session-Id on their side would change based on the
3GPP-NSAPI value that could (and in most cases) changes.

< Acknowledgement Sent back

>From what I've been reading, The Acct-Session-Id should remain
constant for the entire PDP context/session, even when the NSAPI
changes because the Acct-Session-Id is meant to uniquely identify the
entire user session. NSAPI changes are considered sub-sessions within
the main PDP context and keeping the same Acct-Session-Id helps
maintain session continuity for billing and tracking purposes, which
is exactly our use case for accounting which is not working as
expected.

Any thoughts and insights would be appreciated if someone faced a
similar situation.


Many thanks, Gabriel
-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

--------------------------------------------------------------------
This email is from an external source. Please do not open attachments or click links from an unknown or suspicious origin. Phishing attempts can be reported by using the report message button in Outlook or sending them as an attachment to phishing at sky.uk. Thank you
--------------------------------------------------------------------
Information in this email including any attachments may be privileged, confidential and is intended exclusively for the addressee. The views expressed may not be official policy, but the personal views of the originator. If you have received it in error, please notify the sender by return e-mail and delete it from your system. You should not reproduce, distribute, store, retransmit, use or disclose its contents to anyone. Please note we reserve the right to monitor all e-mail communication through our internal and external networks. SKY and the SKY marks are trademarks of Sky Limited and Sky International AG and are used under licence.

Sky UK Limited (Registration No. 2906991), Sky-In-Home Service Limited (Registration No. 2067075), Sky Subscribers Services Limited (Registration No. 2340150) and Sky CP Limited (Registration No. 9513259) are direct or indirect subsidiaries of Sky Limited (Registration No. 2247735). All of the companies mentioned in this paragraph are incorporated in England and Wales and share the same registered office at Grant Way, Isleworth, Middlesex TW7 5QD