(RADIATOR) Duplicate Requests - Randomness

[Joe Hughes]

We have a strange issue that has only recently started to occur. First
some background. Our Radiator box authenticates ADSL users, allocates
addresses and receives accounting messages to track usage. It
allocates addresses from a database table and also stores accounting
information in the database.

We have some checks in the various stored procedures to block
duplicate logon attempts and also to do things like detect orphaned
sessions (Occasionally the NAS\User-session will hang, usually
indicated by a lack of accounting-updates).

Recently, every two weeks at 00:55am - 01:00am - we seem to get a load
of duplicate requests and lost packets that cause us some problems.
For maybe a one or two minute period;

- STOP messages are lost if a session ends, so the session ends on the
NAS, but not in our database; causing duplicate login attempts (We
think they are online)
- Accounting message are ignored, our system then flags them as
potentially orphaned

The logs show duplicate requests;

Sun Aug  5 00:58:06 2007: INFO: Duplicate request id 98 received from
x.x.x.x(1645): ignored
Sun Aug  5 00:58:06 2007: INFO: Duplicate request id 98 received from
x.x.x.x(1645): ignored
Sun Aug  5 00:58:06 2007: INFO: Duplicate request id 98 received from
x.x.x.x(1645): ignored
Sun Aug  5 00:58:06 2007: INFO: Duplicate request id 99 received from
x.x.x.x(1645): ignored
Sun Aug  5 00:58:06 2007: INFO: Duplicate request id 99 received from
x.x.x.x(1645): ignored
Sun Aug  5 00:58:06 2007: INFO: Duplicate request id 99 received from
x.x.x.x(1645): ignored

This only happens every other Sunday morning.

We have checked obvious things like backup schedules, traffic levels,
firewall logs and nothing. This doesn't happen any other day  - but I
can't explain what is unique about this time to trigger these events.

Its a Cisco 7206 acting as a ADSL L2TP termination point, a common
ADSL deployment model.

I will run at a higher trace next Sunday to see if I can work out
exactly what is going on, its very odd.

Is there anything obvious I should check? I think it *must* be a
scheduled task of some description, but so far, this has drawn a blank

--
Archive at http://www.open.com.au/archives/radiator/
Announcements on radiator-announce at open.com.au
To unsubscribe, email 'majordomo at open.com.au' with
'unsubscribe radiator' in the body of the message.