<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN"><HTML><HEAD><META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=utf-8"></HEAD><BODY><DIV>The scenario</DIV>
<DIV>-------------</DIV>
<DIV>LNS terminating 500+ adsl users.</DIV>
<DIV>The tunnel goes down/up, so all users are trying again to authenticate
simultaneusly.</DIV>
<DIV>Radius server isn't able to handle all those requests, so some udp packets
are dropped.</DIV>
<DIV>Router has to retransmit all these requests that aren't replied.</DIV>
<DIV>Since unique-id is only 8 bits, we can have 255 concurrent unique
access-requests.</DIV>
<DIV> </DIV>
<DIV>Router sends a access-request using an id and at the same time
the radius is using the same id </DIV>
<DIV>in order to reply to the router for a previous request (which also had this
id). </DIV>
<DIV>So the router thinks that this reply from the radius is about the last
request, </DIV>
<DIV>but this is actually for the previous request (both had the same
id).</DIV>
<DIV> </DIV>
<DIV>The result</DIV>
<DIV>----------</DIV>
<DIV>A user which is not allowed to login, will be authenticated normally and
</DIV>
<DIV>will get all radius attributes of another user (who is allowed to
login)!!!</DIV>
<DIV> </DIV>
<DIV>Can the above result be considered a bug from router's side?</DIV>
<DIV>Is this the way radius authentication is supposed to work?</DIV>
<DIV>If yes, how can something like this be considered
secure?</DIV></BODY></HTML>