Monday, January 11, 2016

Wifi RADIUS accounting packets out of order

I received this packet capture from a customer. According to the IT admin the AP was sending RADIUS accounting interim updates after RADIUS accounting stop message. I looked at the packet capture and it actually was true, there was a RADIUS accounting interim update after the client was disconnected. I started the investigation,

I used the filter (radius.Calling_Station_Id == "70-48-0F-63-6B-D1") && !(radius.code == 1),

I had to explain why there was an interim update after accounting stop, and I started by comparing what is the difference between this accounting stop and accounting interim update. Those were sent from the same AP for the same calling station ID mac address. After comparing the RADIUS attributes of the two packets I found something inserting. 

In the two packets the radius.Connect_Info is different, in the accounting stop the value is 11ac which is 802.11ac , therefore the client disconnected from 5GHz. Then the accounting interim update has the value 11ng which is 802.11n/g, therefore the client has connected to 2.4GHz in the same AP. To explain what happened clearly I added a new column in Wireshak with filter radius.Connect_Info,

Post a Comment