<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Exchange Server">
<!-- converted from rtf -->
<style><!-- .EmailQuote { margin-left: 1pt; padding-left: 4pt; border-left: #800000 2px solid; } --></style>
</head>
<body>
<font face="Arial" size="2"><span style="font-size:11pt;">
<div>Roberto,<br>
<br>
<br>
<br>
we have a wireless controller that sends MAC addresses in this format:<br>
<br>
<font face="Courier New"> </font><font face="Courier New">20-5e-aa-33-18-2f</font></div>
<div> </div>
<div>It does so for the client (Calling-Station) MAC as well as that of the WAP being used (Called-Station).</div>
<div>To get these addresses to match the format used by other systems I use the following method.<br>
</div>
<div>In the main Radiator config file there is the following hook:</div>
<div>… </div>
<div><font face="Courier New"> # Rewrite Cisco-style '20-5e-aa-33-18-2f' to common '20:5e:aa:33:18:2f'</font></div>
<div><font face="Courier New"> #</font></div>
<div><font face="Courier New"> PreClientHook file:"/usr/local/etc/radiator/hook-files/RewriteMAC.pl"</font></div>
<div>…</div>
<div> </div>
<div>The hook-file itself looks like this</div>
<div> </div>
<div><font face="Courier New"># Rewrite MAC addresses</font></div>
<div><font face="Courier New">#</font></div>
<div><font face="Courier New"># The cisco Wireless Controllers use dashes (-) for MAC addresses in</font></div>
<div><font face="Courier New"># the Radius requests.</font></div>
<div><font face="Courier New"># For analyses purposes they are rewritten to more commen colons (:).</font></div>
<div><font face="Courier New">sub</font></div>
<div><font face="Courier New">{</font></div>
<div><font face="Courier New"> my $p = ${$_[0]};</font></div>
<div><font face="Courier New"> my $clientmac;</font></div>
<div><font face="Courier New"> my $wapmac;</font></div>
<div><font face="Courier New"> </font></div>
<div><font face="Courier New"> if ($clientmac = $p->get_attr('Calling-Station-Id'))</font></div>
<div><font face="Courier New"> {</font></div>
<div><font face="Courier New"> &main::log($main::LOG_DEBUG,</font></div>
<div><font face="Courier New"> "Calling-Station-Id = $clientmac");</font></div>
<div><font face="Courier New"> $clientmac =~ tr/-/:/;</font></div>
<div><font face="Courier New"> $p->change_attr('Calling-Station-Id', $clientmac);</font></div>
<div><font face="Courier New"> }</font></div>
<div><font face="Courier New"> if ($wapmac = $p->get_attr('Called-Station-Id'))</font></div>
<div><font face="Courier New"> {</font></div>
<div><font face="Courier New"> &main::log($main::LOG_DEBUG,</font></div>
<div><font face="Courier New"> "Called-Station-Id = $wapmac");</font></div>
<div><font face="Courier New"> $wapmac =~ tr/-/:/;</font></div>
<div><font face="Courier New"> $p->change_attr('Called-Station-Id', $wapmac);</font></div>
<div><font face="Courier New"> }</font></div>
<div><font face="Courier New"> return;</font></div>
<div><font face="Courier New">}</font></div>
<div> </div>
<div>A proper Perl coder could do a better job, but for us, this gets the job done.</div>
<div>As your starting format differs, you will have to change the two actual rewrites; they probably should look something like this:</div>
<div> </div>
<div><font face="Courier New"> $clientmac =~ s/^([a-f0-9]{2})([a-f0-9]{2}:[a-f0-9]{2})([a-f0-9]{2}:[a-f0-9]{2})([a-f0-9]{2})$/$1:$2:$3:$4/;</font></div>
<div>and</div>
<div><font face="Courier New"> $wapmac =~ s/^([a-f0-9]{2})([a-f0-9]{2}:[a-f0-9]{2})([a-f0-9]{2}:[a-f0-9]{2})([a-f0-9]{2})$/$1:$2:$3:$4/;</font></div>
<div> </div>
<div> </div>
<div> </div>
<div>Hope this can help getting to where you want!</div>
<div> </div>
<div> </div>
<div>Ydo</div>
<div> </div>
<div>--</div>
<div>Ydo Ehlers | IT Beheerder | ICT Service Center | Radboud Universiteit | Postbus 9102, 6500 HC Nijmegen | (024) 361 78 94 |
<a href="http://www.ru.nl/isc">www.ru.nl/isc</a></div>
<div> </div>
<div>Dit bericht en elke eventuele bijlage is uitsluitend bestemd voor de geadresseerde(n) en kan vertrouwelijke informatie bevatten. Indien u niet de geadresseerde bent mag u dit bericht en de bijlage niet kopiëren of aan derden ter inzage geven of verspreiden.
</div>
<div>U wordt verzocht de afzender hiervan onmiddellijk op de hoogte te stellen en het bericht te vernietigen.</div>
<div> </div>
<div>> -----Original Message-----</div>
<div>> From: radiator <radiator-bounces@lists.open.com.au> On Behalf Of Hugh Irvine</div>
<div>> Sent: Thursday, February 20, 2020 10:53 PM</div>
<div>> To: Ullfig, Roberto Alfredo <rullfig@uic.edu></div>
<div>> Cc: radiator@lists.open.com.au</div>
<div>> Subject: Re: [RADIATOR] MAC Address Log Format</div>
<div>> </div>
<div>> </div>
<div>> Hello Roberto -</div>
<div>> </div>
<div>> Take a look at a Trace 4 debug - I’m guessing what you show below is what is in the</div>
<div>> Calling-Station-Id sent be the client.</div>
<div>> </div>
<div>> If that is the case you will probably need a hook to reformat it as you want.</div>
<div>> </div>
<div>> regards</div>
<div>> </div>
<div>> Hugh</div>
<div>> </div>
<div>> </div>
<div>> > On 21 Feb 2020, at 07:40, Ullfig, Roberto Alfredo <<a href="mailto:rullfig@uic.edu">rullfig@uic.edu</a>> wrote:</div>
<div>> ></div>
<div>> > Can the MAC Address format be changed for logging purposes to this:</div>
<div>> ></div>
<div>> > ab:cd:ef:12:34:56</div>
<div>> ></div>
<div>> > it currently logs as this</div>
<div>> ></div>
<div>> > abcd:ef12:3456</div>
<div>> ></div>
<div>> > using %{OuterRequest:Calling-Station-Id}</div>
<div>> ></div>
<div>> > ---</div>
<div>> > Roberto Ullfig - <a href="mailto:rullfig@uic.edu">rullfig@uic.edu</a></div>
<div>> > Systems Administrator</div>
<div>> > Enterprise Architecture and Development | ACCC University of Illinois</div>
<div>> > - Chicago _______________________________________________</div>
<div>> > radiator mailing list</div>
<div>> > <a href="mailto:radiator@lists.open.com.au">radiator@lists.open.com.au</a></div>
<div>> > <a href="https://lists.open.com.au/mailman/listinfo/radiator">https://lists.open.com.au/mailman/listinfo/radiator</a></div>
<div>> </div>
<div>> </div>
<div>> --</div>
<div>> </div>
<div>> Hugh Irvine</div>
<div>> <a href="mailto:hugh@open.com.au">hugh@open.com.au</a></div>
<div>> </div>
<div>> Radiator: the most portable, flexible and configurable RADIUS server</div>
<div>> anywhere. SQL, proxy, DBM, files, LDAP, NIS+, password, NT, Emerald,</div>
<div>> Platypus, Freeside, TACACS+, PAM, external, Active Directory, EAP, TLS,</div>
<div>> TTLS, PEAP, TNC, WiMAX, RSA, Vasco, Yubikey, MOTP, HOTP, TOTP,</div>
<div>> DIAMETER, SIM, etc.</div>
<div>> Full source on Unix, Linux, Windows, macOS, Solaris, VMS, NetWare etc.</div>
<div>> </div>
<div>> _______________________________________________</div>
<div>> radiator mailing list</div>
<div>> <a href="mailto:radiator@lists.open.com.au">radiator@lists.open.com.au</a></div>
<div>> <a href="https://lists.open.com.au/mailman/listinfo/radiator">https://lists.open.com.au/mailman/listinfo/radiator</a></div>
<div> </div>
</span></font>
</body>
</html>