[radext] Re: Accounting overload with AP roaming

Alan DeKok <alan.dekok@inkbridge.io> Fri, 03 July 2026 13:00 UTC

Return-Path: <alan.dekok@inkbridge.io>
X-Original-To: radext@mail2.ietf.org
Delivered-To: radext@mail2.ietf.org
Received: from localhost (localhost [127.0.0.1]) by mail2.ietf.org (Postfix) with ESMTP id AEBD910DA80FB for <radext@mail2.ietf.org>; Fri, 3 Jul 2026 06:00:20 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=ietf.org; s=ietf1; t=1783083620; bh=F+7kZqfIRUDO/wcZBoplAyKPOajEOACSiS4m1lp721w=; h=Subject:From:In-Reply-To:Date:Cc:References:To; b=SSsUmNFVh6i0Px9aiwfujVNHvj40hZau6V6pgbgO1/a04OauoF2CNQF6hmT+T9te0 TsQGa8CAbK+L2ySOT+A+lEaAHJVsygfO4k3L/g8ep9LBMTN7Xdf+NUwXDsAH7ZzdPG gcA4sVLnM3cFeoEiCB35GgHTXAfzgCFZ1048cfbA=
X-Virus-Scanned: amavisd-new at ietf.org
X-Spam-Flag: NO
X-Spam-Score: -2.098
X-Spam-Level:
X-Spam-Status: No, score=-2.098 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_VALIDITY_CERTIFIED_BLOCKED=0.001, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Authentication-Results: mail2.ietf.org (amavisd-new); dkim=pass (2048-bit key) header.d=inkbridge.io
Received: from mail2.ietf.org ([166.84.6.31]) by localhost (mail2.ietf.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id YsTxi3GzwhNL for <radext@mail2.ietf.org>; Fri, 3 Jul 2026 06:00:19 -0700 (PDT)
Received: from mail.networkradius.com (mx1-ca.networkradius.com [199.66.222.134]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-256) server-digest SHA256) (No client certificate requested) by mail2.ietf.org (Postfix) with ESMTPS id 3011E10DA775A for <radext@ietf.org>; Fri, 3 Jul 2026 05:59:15 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=inkbridge.io; s=sep2024; t=1783083555; bh=rgHXUV1TMJOkpWx5mQp7WDCTUK4W17Cc3t5E14DFjY4=; h=Subject:From:In-Reply-To:Date:Cc:References:To:From; b=ZZ5Axsp38DZwfg6R2P8Q+LSzJPGvOOCEhFm/BuqYivkjZynvWvq9J4ULzTZWegXiZ ksJTTB+zzaqNzlI5knk4vjJFuto7gZiK7I5SNikeIMohhe0Qup7zl8HexPowTg+nlg 8cbjGEaG20spMq6keOU6C1manz5d09SMP+EppfoLFCoFa/qn97RtT4eOhxYngT1Mn7 xvWV89VKTMSgWZUCA2zMqAME6UjjTTFRwNWrNynEABYor+7JaUeq9cwAiRRO5i62sY kAsdPYXLStzm60eB2iBB4snBXq5ZgfAFtB8qfWktPap3dhkvkuDPpvE1/so4/Z9Jqm xHdERNyUMjegA==
Received: from smtpclient.apple (24-246-4-149.cable.teksavvy.com [24.246.4.149]) by mail.networkradius.com (Postfix) with ESMTPSA id 600E51340097; Fri, 03 Jul 2026 12:59:15 +0000 (UTC)
Content-Type: multipart/signed; boundary="Apple-Mail=_ABBF0E4D-AD1F-4FD3-8E44-4AFCD1A712E4"; protocol="application/pgp-signature"; micalg="pgp-sha256"
Mime-Version: 1.0 (Mac OS X Mail 16.0 \(3826.700.81.1.4\))
From: Alan DeKok <alan.dekok@inkbridge.io>
In-Reply-To: <91838d62-a09c-4688-aff3-16c3b2bd3154@app.fastmail.com>
Date: Fri, 03 Jul 2026 08:59:04 -0400
Message-Id: <7A126D3E-B59D-43DF-AF1C-772A634EEDAB@inkbridge.io>
References: <7E705F64-EC36-4110-823F-77820D32FF26@inkbridge.io> <542b8068-aae2-6e9c-5166-b68b69a98e67@iea-software.com> <8F0022F2-DE6F-4BE9-8C6C-B4D88B01D459@inkbridge.io> <cc272667-9912-a755-b936-efa979fec4dd@iea-software.com> <372B8CC9-C788-4ECF-9DEC-49DD0696CB9D@inkbridge.io> <PH7PR10MB603527E777E3103128687045BAF52@PH7PR10MB6035.namprd10.prod.outlook.com> <91838d62-a09c-4688-aff3-16c3b2bd3154@app.fastmail.com>
To: Alexander Clouter <alex=2Bietf=40coremem.com@dmarc.ietf.org>
X-Mailer: Apple Mail (2.3826.700.81.1.4)
Message-ID-Hash: K2SJP5PHJIFKJZWN6XBNKFN6O5V6TMPE
X-Message-ID-Hash: K2SJP5PHJIFKJZWN6XBNKFN6O5V6TMPE
X-MailFrom: alan.dekok@inkbridge.io
X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; header-match-radext.ietf.org-0; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header
CC: "radext@ietf.org" <radext@ietf.org>
X-Mailman-Version: 3.3.9rc6
Precedence: list
Subject: [radext] Re: Accounting overload with AP roaming
List-Id: RADIUS EXTensions working group discussion list <radext.ietf.org>
Archived-At: <https://mailarchive.ietf.org/arch/msg/radext/ZXgvG6U5yhUdfMEodR6eWAEIBxU>
List-Archive: <https://mailarchive.ietf.org/arch/browse/radext>
List-Help: <mailto:radext-request@ietf.org?subject=help>
List-Owner: <mailto:radext-owner@ietf.org>
List-Post: <mailto:radext@ietf.org>
List-Subscribe: <mailto:radext-join@ietf.org>
List-Unsubscribe: <mailto:radext-leave@ietf.org>

On Jul 3, 2026, at 2:22 AM, Alexander Clouter <alex=2Bietf=40coremem.com@dmarc.ietf.org> wrote:
> Not trying to make this sound like a "but why haven't you just tried nerding harder", but for a time series database this is a niche they are very well suited for.
> 
> This can be complemented, or grafted onto an existing deployment by tiering your ingress. The front holds onto "live sessions" in a real-time database (RDB) and then flushes them to a historical database (HDB). This is a well used and understood pattern.

  And one which I've deployed lots.  The issue is that this design pattern solves a different problem.

> Those other operators still require non-coalesced Stop/Start/Update signalling. What should they do and how do they use the data?

  They should treat this like any other change of functionality.

  If we stop all progress because "it's a change", then we can't ever fix things.  And people who want to use this within their networks, on their equipment, will be forbidden from using it.

> I likely am mis-understanding and missing the simplicity here, but at the moment the only way I can see Periodic-Update working is to have a completely parallel event stream with its own Acct-Multi-Session-Id and Acct-Session-Id attributes so subscribers to that event stream get the data they expect.

  It shouldn't be a parallel stream.  It should replace start / interim-update / stop packets.

> I can see the attractiveness of reducing session count at source, but vendors (including Alan) are pushing the message "you do not know how to DB, we do, hire us to fix it" and then deploy tiering.

  Well, no.

  I've talked to people who are (1) using a custom RADIUS server purpose-built for their environment, and (2) using the whole modern stack with Kafka, real-time databases, etc.    They still disable accounting, because the stream of packets is too much.


  The idea that the efficiency doesn't matter is best exemplified by one vendor I worked with decades ago.  They had a mantra of "CPU is commodity, disk is commodity, memory is commodity".  They just wrote code under the assumption that faster systems would always make up for developer negligence.

  Big surprise, it didn't.  Other vendors with 1/10 the hardware outperformed them.  When the packet rates increased, the "big" vendor fell over, and the "small" vendor succeeded.

  Fast systems can always be overwhelmed when the input packet rate increases.    Dropping the load by a large factor is a potentially useful engineering solution.  It also lowers CAPEX because you need smaller systems to achieve the same load.

  Alan DeKok.