This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

alt text

I have a device sending RADIUS accounting packets to my Firewall. I got raw captures from the device and when I look at the AVP in the packet for Framed-IP-Address I get an error.

AVP: l=14 t=Framed-IP-Address(8): [wrong length for IP address]

Anyone ever see this and does it mean that the device is sending an improperly formatted IP in the packet?

When I export selected backet bytes I get the following output: xx10.15.29.253 (something is in front of the IP shows up as unrecognized characters so I cannot display them in this post but they are where the xx are). Perhaps this is it? I just don't know what this is supposed formatted.

asked 02 Oct '14, 08:24

tjjohnsto's gravatar image

tjjohnsto
15115
accept rate: 0%

edited 02 Oct '14, 08:29


As I read RFC 2865 section 5.8, the device is sending the Framed-IP-Address in the wrong format. It should consist of 6 bytes: 1 byte of Type, 1 byte of Length, and 4 bytes of IP(v4) address.

It would appear that the device in question mistakenly encoded the IP address in ASCII (12 bytes).

permanent link

answered 02 Oct '14, 11:24

JeffMorriss's gravatar image

JeffMorriss ♦
6.2k572
accept rate: 27%

Jeff,

This was the correct answer. Thanks a lot. Now they will go back and fix their software.

(03 Oct '14, 07:16) tjjohnsto
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×25
×11

question asked: 02 Oct '14, 08:24

question was seen: 3,584 times

last updated: 03 Oct '14, 07:16

p​o​w​e​r​e​d by O​S​Q​A