Hi!
Currently I'm testing freeradius also as accounting server (we have to
change our script stuff to make the full switch) and I'm encountering
mysterious accounting packets (about 10 in one hour -- from different
NASes, even different vendors [ascend, cisco, redback]).
They get added a Client-Ip-Address = vlan-aaa2 (only defined in
/etc/hosts as 192.168.24.2, not interface has this ip) und so the
pakets get accounted in a detail file below this path.
I don't know where this comes from.
example paket (tcpdump -s 0 -X)
13:35:34.714060 max0.pop-koblenz.rz-online.NET.afs3-rmtsys > aaa1.rz-online.NET.
radius-acct: rx abort (153)
0x0000 4500 00b5 0073 0000 3f11 85b6 d407 acc2 E....s..?.......
0x0010 d407 a03d 1b61 0715 00a1 416a 044f 0099 ...=.a....Aj.O..
0x0020 0a63 67e4 5e98 56e0 8f6a 805c 3544 b0f6 .cg.^.V..j.\5D..
0x0030 0406 d407 acc2 0506 0000 0489 3d06 0000 ............=...
0x0040 0002 2806 0000 0002 2906 0000 0000 2c0c ..(.....).....,.
0x0050 3432 3231 3533 3639 3400 c306 0000 002a 422153694......*
0x0060 c406 0000 0041 c506 0000 fa00 c606 0000 .....A..........
0x0070 0003 be06 0000 00a1 bf06 0000 007c c006 .............|..
0x0080 0000 000b c106 0000 000b ff06 0000 fa00 ................
0x0090 7806 0000 002e 7906 0000 0007 7a06 0000 x.....y.....z...
0x00a0 0001 1f0b 3236 3131 3332 3730 321e 0839 ....261132702..9
0x00b0 3834 3536 30 84560
and that dets into vlan-aaa2/detail:
Fri Jun 20 13:35:34 2003
NAS-IP-Address = 212.7.172.194
NAS-Port = 1161
NAS-Port-Type = ISDN
Acct-Status-Type = Stop
Acct-Delay-Time = 0
Acct-Session-Id = "422153694"
X-Ascend-Disconnect-Cause = 42
X-Ascend-Connect-Progress = 65
X-Ascend-Data-Rate = 64000
X-Ascend-PreSession-Time = 3
X-Ascend-Pre-Input-Octets = 161
X-Ascend-Pre-Output-Octets = 124
X-Ascend-Pre-Input-Packets = 11
X-Ascend-Pre-Output-Packets = 11
X-Ascend-Xmit-Rate = 64000
X-Ascend-Modem-PortNo = 46
X-Ascend-Modem-SlotNo = 7
X-Ascend-Modem-ShelfNo = 1
Calling-Station-Id = "261132702"
Called-Station-Id = "984560"
Client-IP-Address = vlan-aaa2
Timestamp = 1056108934
Any idea where this gets mixed up?
Oliver.
-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
