[radext] Client ID exhaustion

[Stefan Winter <[e-mail]>]

Hello,


we keep hearing assertions on the list that change is needed regarding
the ID field in RADIUS.


I would like to recall RFC2865's section 2.5


"If a

   NAS needs more than 256 IDs for outstanding requests, it MAY use
   additional source ports to send requests from, and keep track of IDs
   for each source port.  This allows up to 16 million or so outstanding
   requests at one time to a single server."


It's fairly clear that implementations which do not follow the MAY will
run into exhaustion problems rather soon.

It's less clear that implementations which do follow this MAY still do.
We've heard finger-in-the-air calculations on the list that this may
become a problem earlier than one might think. But is there actual
evidence to that end in deployed reality?

Can someone please share their experience regarding a deployment and
implementation which DOES implement the MAY above but STILL runs out of
RADIUS packet IDs?

Obviously, for those implementors which do not implement the MAY, the
suggestion would be to implement that before trying to make protocol
changes. The corresponding advice in RFC2865 may be 17 years old now,
but that doesn't mean it is not good advice.

Greetings,

Stefan Winter

-- 
Stefan WINTER
Ingenieur de Recherche
Fondation RESTENA - Réseau Téléinformatique de l'Education Nationale et de la Recherche
2, avenue de l'Université
L-4365 Esch-sur-Alzette

Tel: [phone]
Fax: [phone]

PGP key updated to 4096 Bit RSA - I will encrypt all mails if the recipient's key is known to me

http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xC0DE6A358A39DC66