Radius Error Received Conflicting Packet From Client
] [ author ] Ivan Kalik wrote: >>>> Our radius-server timeout is high enough: 4 minutes. Once again: I >>>> suppose that what freeradius thinks of as "Received conflicting packet >>>> ..." are rather a bit delayed packets normally treated as "Discarding >>>> conflicting packet ...", i.e. they arrive at freeradius in maybe 1.01+ >>>> second after the first request, but freeradius drops the current >>>> request >>>> instead of the new one. Soon I'm gonna rebuild freeradius with changed >>>> tv_sec and check that. >>> huh? do you not understand the basic context of this issue? if the NAS >>> has sent a repeat RADIUS packet then it means that the original packet >>> has already been timed out and the NAS should NOT accept an 'accept' >>> response >>> on that original packet. >> Please see the comment from the code snippet in src/main/event.c in my >> original posting. Some duplicate packets might arrive after 1 sec. by a >> slight margin, even though they logically are whatever that >> special-cased conditional was designed to handle. > > 1 second? Freeradius keeps track of duplicates for 5 minutes by default. > That is if processing has been completed. But in your case requests are > still being processed 4 minutes after NAS sent them (if that is your retry > interval on the NAS as you claim - default is usually 2 minutes). That is > why it gave up on them and sent a new request. How do you think that > adjusting that 1 second interval is going to help *your* case??? > Trying for the third time: there are many, many requests of the "Discarding conflicting packet" kind, which for one reason or another are dupped by our Cisco NASes in under one second (see the code). And there are many, many lines of the "Received conflicting packet" fame (see the code). Now, it can be logically deduced that a big part of the latter are indeed of the former type (because none of the NASes have timeouts as low as 2-5 seconds). What I'd really love is for freeradius to
Sign in Pricing Blog Support Search GitHub This repository Watch 76 Star 452 Fork 415 FreeRADIUS/freeradius-server Code Issues 40 Pull requests 8 Projects 2 Pulse Graphs New issue DHCP - FreeRADIUS complains about conflicting packets #941 Closed nchaigne opened this Issue Mar 27, 2015 · 6 comments Labels None yet Milestone No milestone Assignees No one assigned 3 participants nchaigne commented Mar 27, 2015 I have a FreeRADIUS doing DHCP (configured with "cleanup_delay = 0"). I'm sending lots of DORA transactions to the server. I never reuse the same http://lists.freeradius.org/pipermail/freeradius-users/2009-October/041900.html transaction ID, except within a given DORA (as specified in RFC 2131, the ID of the Request should be the same as in the corresponding Offer / Discover). The issue is the following: I regularly get the following message in the logs: Fri Mar 27 17:22:36 2015 : Error: Received conflicting packet from client dhcp port 42067 - ID: 98534 due to unfinished request. https://github.com/FreeRADIUS/freeradius-server/issues/941 Giving up on old request. child_state: 2, codes=1025 1027 (I added "child_state: 2, codes=1025 1027" to try and understand what's going on...) From what I understand, this happens when: FreeRADIUS has processed a given Discover, sent back an Offer; Receives the Request corresponding to this Offer (same transaction Id), and finds the Discover still in his request hash (and apparently still with a child_state == REQUEST_RUNNING). I'm not sure how it can happen. Isn't the first packet supposed to be cleaned-up immediately with "cleanup_delay" set to 0 ? And even if it isn't, how can the child still be running the request ? Maybe there's a race condition ? it only seems to happen under heavy load. FreeRADIUS project member alandekok commented Mar 27, 2015 Is this with v3.0.x head? Or another version? You can work around this by updating the DHCP �listen� section to have: performance { skip_duplicate_checks = true } So it will skip all of the conflicting packet issues. … On Mar 27, 2015, at 11:51 AM, Nicolas C ***@***.***> wrote: I have a FreeRADIUS doing DHCP (configured with "cleanup_delay = 0"). I'm sending lots of D
Регистрация Список форумов Технические вопросы Сообщения об ошибках и поддержка Поиск [Cisco+Radiu] Error: Received conflicting packet from client Ответить Версия для печати Поиск Расширенный поиск 5 сообщений • Страница 1 http://abills.net.ua/forum/viewtopic.php?t=4425 из 1 chtito2 Сообщения: 479 Зарегистрирован: Чт апр 17, 2008 5:26 pm [Cisco+Radiu] Error: Received conflicting packet from client Цитата Сообщение chtito2 » Чт ноя 27, 2008 1:00 pm Когда Cisco включается и сотни PPPoE пользователей пытаются авторизоваться через RADIUS сервер, в логе последнего сыпется шторм ошибок вроде этих: Thu Nov radius error 27 12:44:06 2008 : Error: Received conflicting packet from client x.y.31.1 port 1646 - ID: 93 due to unfinished request 54538. Giving up on old request.Thu Nov 27 12:44:06 2008 : Error: Received conflicting packet from client x.y.31.1 port 1646 - ID: 96 due to unfinished request 54541. Giving up radius error received on old request.Thu Nov 27 12:44:06 2008 : Error: Received conflicting packet from client x.y.31.1 port 1646 - ID: 97 due to unfinished request 54542. Giving up on old request.Thu Nov 27 12:44:06 2008 : Error: Received conflicting packet from client x.y.31.1 port 1646 - ID: 101 due to unfinished request 54545. Giving up on old request. и их сотни за 2-3 секунды. В результате многие каким-то образом получают дублированные адреса, многие пользователи садятся в онлайн с IP адресом, отличным от зарегистрированного в таблице онлайнов Абиллса, а некоторых сидящих пользователей вобще нет в таблице. Вобщем кошмар. Кто реально сталкивался с таким и знает, как побороть? Может как-то перенастроить Cisco IOS? Замечу, что в рутинных условиях ошибка не появляется. Методом тыка установлено, что она возникает в двух случаях: а) перезагрузка Cisco, влечащая за собой одновременный заход сотен pppoe клиентов; б) кик всех сидящих (командой clear pppoe sess all) с их по