(RADIATOR) Bad authenticator in wrong packet?

[Paul]

Hi Everyone,

We are running Radiator 3.7.1 and every 2 hours or so we see the following
packet come through and directly below is a "Bad authenticator" however the
IP address mentioned is different to the one that is in the "Recieved" from
header. So it's like Radiator is getting mixed up as to which host has the
"Bad authenticator" packet issue.

Checking through a full two hours of logs and we can't find a single packet
that was sent from 192.168.100.100 to even remotely match the wrong packet.

Has anyone seen this type of behaviour?

Wed May  5 15:01:13 2004 617315: DEBUG: Packet dump:
*** Received from 200.150.150.150 port 34123 ....
Code:       Accounting-Request
Identifier:   57
Authentic:  <170><112>gG<45><123><100><7><333>EE<03><123><50>O<125>
Attributes:
        Acct-Session-Id = "00093EJ2A"
        Tunnel-Server-Endpoint = 0:172.100.10.10
        Tunnel-Client-Endpoint = 0:10.10.10.10
        Tunnel-Assignment-ID = 0:1
        Tunnel-Type = 0:L2TP
        Tunnel-ID = 0:390325
        Tunnel-Client-Auth-ID = 0:n43325267k-cwv13
        Tunnel-Server-Auth-ID = 0:my-cool-nas01
        Framed-Protocol = PPP
        Framed-IP-Address = 120.100.100.100
        Ascend-Connect-Progress = prLanSessionUp
        Acct-Authentic = RADIUS
        Acct-Status-Type = Start
        NAS-Port = 50
        Calling-Station-Id = "atm 20"
        Called-Station-Id = "0:1.150#999111000##speed:UBR:1536#/"
        Service-Type = Framed-User
        NAS-IP-Address = 200.200.200.200
        Ascend-Session-Svr-Key = "8DQ2KCE0"
        Event-Timestamp = 1083733257
        NAS-Identifier = "my-cool-nas01.ournet.com.au"
        Acct-Delay-Time = 15
        User-Name = "12345678 at hehe.com.au"
        NAS-Port-Type = ADSL-DMT
        Timestamp = 1083733259
        Proxy-State = OSC-Extended-Id=1201

Wed May  5 15:01:13 2004 617958: DEBUG: Rewrote user name to
12345678 at hehe.com.au
Wed May  5 15:01:13 2004 618200: DEBUG: Rewrote user name to
12345678 at hehe.com.au
Wed May  5 15:01:13 2004 618649: WARNING: Bad authenticator in request from
192.168.100.100 (200.200.200.200)

Any ideas/clues would be great.

Thanks

Paul

--
Archive at http://www.open.com.au/archives/radiator/
Announcements on radiator-announce at open.com.au
To unsubscribe, email 'majordomo at open.com.au' with
'unsubscribe radiator' in the body of the message.