In a RADIUS Access-Request, which attributes tell the server where and how a user is connecting?

## The attempt, not just the account A RADIUS **Access-Request (Code 1)** is a short header followed by a list of **attribute-value pairs**, and nearly everything a policy decision rests on lives in that list. One or two attributes carry a credential; the rest describe the *circumstances* of the attempt — which account is being claimed, which device is connecting, which network it reached, which piece of equipment is asking, and over what medium. The server sees exactly what the network access server chose to include, and nothing else. An attribute that was not sent is not a default: it is an absence. One thing to be precise about before the vocabulary: on the wire an attribute is a **number**, not a name. `User-Name` is type 1 and travels as the octet `1`. The readable names used here are what the attribute definitions configured at each end map those numbers onto, which is why two deployments that disagree about a number disagree about the whole attribute. ## The vocabulary that describes the attempt | Attribute | Type | What it names | |---|---|---| | `User-Name` | 1 | The identity being claimed, often qualified with a realm suffix | | `NAS-IP-Address` | 4 | The address of the access device that sent the request | | `NAS-Identifier` | 32 | A name for that same device, where an address is not wanted | | `NAS-Port` | 5 | The physical or logical port on the access device | | `NAS-Port-Type` | 61 | The medium of that port — `Virtual (5)`, `Ethernet (15)`, `Wireless - IEEE 802.11 (19)` | | `Called-Station-Id` | 30 | The identifier of the end that was called | | `Calling-Station-Id` | 31 | The identifier of the end doing the calling | | `Service-Type` | 6 | The kind of service requested — `Framed (2)`, `Administrative (6)`, `Call Check (10)` | ## Two ends, two station identifiers The pair that gets inverted most often is the two station identifiers, and the names give the answer if you read them as a telephone call. `Calling-Station-Id` (31) is the **calling** end: the device that initiated the connection, filled in by the access device from what it sees at the link layer. `Called-Station-Id` (30) is the **called** end: the equipment or network that was reached. On a cruise ship's passenger wireless network, that pair is what separates one attempt from another. `Called-Station-Id` (30) distinguishes the passenger network from the crew network served by the same equipment, and `Calling-Station-Id` (31) is how the server recognises that this is the same handset that connected in the atrium an hour ago. Neither identifier is a credential; both are descriptions the access device supplies alongside one. ## Which equipment is asking, and over what `NAS-IP-Address` (4) and `NAS-Identifier` (32) both name the access device, and RFC 2865 requires an Access-Request to carry at least one of them — a server that cannot tell which device is asking cannot apply device-scoped policy at all. `User-Name` (1) is only a *should* by comparison: the specification recommends it rather than demanding it. `NAS-Port` (5) is the port on that device. It is a port in the patch-panel sense, physical or logical, and has nothing to do with the transport port numbers RADIUS itself runs on. `NAS-Port-Type` (61) says what *kind* of port it is: aboard the ship a cabin's socket comes in as `Ethernet (15)` and the deck wireless as `Wireless - IEEE 802.11 (19)`, and a server can price, filter or refuse on that distinction without knowing anything about the equipment's model. `Service-Type` (6) rounds the picture off with the kind of service being requested — `Framed (2)` for a session that will be given network access, `Administrative (6)` where administrative service is asked for, `Call Check (10)` where the attempt is a check on the calling identifier rather than a user logging in. ## What the list settles, and what it does not - The attributes are a **description**, not a proof; the credential attributes are separate members of the same list. - Order matters only among repeated instances of the *same* attribute; the list as a whole is not an ordered narrative. - An access device that omits an attribute has not sent a neutral value — the server simply has less to decide on. - `NAS-Identifier` (32) and `NAS-IP-Address` (4) are different attributes with different type numbers; a request may carry either or both. - The names are local, the numbers are the protocol. A missing definition at one end turns a well-formed attribute into an unknown type.