I have a device sending RADIUS accounting packets to my Firewall. I got raw captures from the device and when I look at the AVP in the packet for Framed-IP-Address I get an error. AVP: l=14 t=Framed-IP-Address(8): [wrong length for IP address] Anyone ever see this and does it mean that the device is sending an improperly formatted IP in the packet? When I export selected backet bytes I get the following output: xx10.15.29.253 (something is in front of the IP shows up as unrecognized characters so I cannot display them in this post but they are where the xx are). Perhaps this is it? I just don't know what this is supposed formatted. asked 02 Oct '14, 08:24  tjjohnsto edited 02 Oct '14, 08:29 |
One Answer:
As I read RFC 2865 section 5.8, the device is sending the Framed-IP-Address in the wrong format. It should consist of 6 bytes: 1 byte of Type, 1 byte of Length, and 4 bytes of IP(v4) address. It would appear that the device in question mistakenly encoded the IP address in ASCII (12 bytes). answered 02 Oct '14, 11:24  JeffMorriss ♦ |
Jeff,
This was the correct answer. Thanks a lot. Now they will go back and fix their software.