This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

RADIUS AVP - Framed-IP-Address error

0

alt text

I have a device sending RADIUS accounting packets to my Firewall. I got raw captures from the device and when I look at the AVP in the packet for Framed-IP-Address I get an error.

AVP: l=14 t=Framed-IP-Address(8): [wrong length for IP address]

Anyone ever see this and does it mean that the device is sending an improperly formatted IP in the packet?

When I export selected backet bytes I get the following output: xx10.15.29.253 (something is in front of the IP shows up as unrecognized characters so I cannot display them in this post but they are where the xx are). Perhaps this is it? I just don't know what this is supposed formatted.

asked 02 Oct '14, 08:24

tjjohnsto's gravatar image

tjjohnsto
15115
accept rate: 0%

edited 02 Oct '14, 08:29


One Answer:

1

As I read RFC 2865 section 5.8, the device is sending the Framed-IP-Address in the wrong format. It should consist of 6 bytes: 1 byte of Type, 1 byte of Length, and 4 bytes of IP(v4) address.

It would appear that the device in question mistakenly encoded the IP address in ASCII (12 bytes).

answered 02 Oct '14, 11:24

JeffMorriss's gravatar image

JeffMorriss ♦
6.2k572
accept rate: 27%

Jeff,

This was the correct answer. Thanks a lot. Now they will go back and fix their software.

(03 Oct '14, 07:16) tjjohnsto