7.The host requests the RADIUS client to tear down the connection and the RADIUS client sends a stop-accounting request (Accounting-Request) to the RADIUS server.

8.The RADIUS server returns an acknowledgement (Accounting-Response) and stops accounting for the user.

RADIUS packet format

RADIUS uses UDP to transmit messages. To ensure smooth message exchange between the RADIUS server and the client, RADIUS uses a timer management mechanism, a retransmission mechanism, and a backup server mechanism. Figure 348 shows the RADIUS packet format.

Figure 348 RADIUS packet format

0

7

15

31

 

 

 

 

 

Code

Identifier

7

 

Length

Authenticator

Attributes

The following describes the fields of a RADIUS packet:

•The Code field (1 byte long) indicates the type of the RADIUS packet. Table 112 Main values of the Code field

Code

Packet type

Description

 

 

From the client to the server. A packet of this type carries user

1

Access-Request

information for the server to authenticate the user. It must contain the

User-Name attribute and can optionally contain the attributes of

 

 

 

 

NAS-IP-Address, User-Password, and NAS-Port.

 

 

 

 

 

From the server to the client. If all attribute values carried in the

2

Access-Accept

Access-Request are acceptable, the authentication succeeds, and the

 

 

server sends an Access-Accept response.

 

 

 

 

 

From the server to the client. If any attribute value carried in the

3

Access-Reject

Access-Request is unacceptable, the authentication fails, and the

 

 

server sends an Access-Reject response.

 

 

 

 

 

From the client to the server. A packet of this type carries user

4

Accounting-Request

information for the server to start or stop accounting for the user. The

Acct-Status-Type attribute in the packet indicates whether to start or

 

 

 

 

stop accounting.

 

 

 

 

 

From the server to the client. The server sends a packet of this type to

5

Accounting-Response

notify the client that it has received the Accounting-Request and has

 

 

successfully recorded the accounting information.

 

 

 

•The Identifier field (1 byte long) is used to match request packets and response packets and to detect duplicate request packets. Request and response packets of the same type have the same identifier.

365