Re: [radext] Client ID exhaustion

[Alan DeKok <[e-mail]>]

On Apr 26, 2017, at 8:43 AM, Stefan Winter <[e-mail]> wrote:
> It's fairly clear that implementations which do not follow the MAY will
> run into exhaustion problems rather soon.

  I think implementations which don't open new source ports are few and far between.  They are typically simple and small.

> It's less clear that implementations which do follow this MAY still do.
> We've heard finger-in-the-air calculations on the list that this may
> become a problem earlier than one might think. But is there actual
> evidence to that end in deployed reality?

  All RADIUS servers open new ports.  All NAS equipment that costs more than $20 opens new ports.

> Can someone please share their experience regarding a deployment and
> implementation which DOES implement the MAY above but STILL runs out of
> RADIUS packet IDs?

  I've never seen one.

  The issue for me is really TCP, and accounting.  It would be useful to be able to send many accounting packets to a server.  It would be useful to "fill" a TCP connection with RADIUS traffic.  The 256 packet limit makes that impossible.

  Whether or not this proposal gets approval, I think it's useful.  If nothing else, I will likely add it as a configurable (not negotiable) extension to my implementation.

  Alan DeKok.