Wireshark-users: Re: [Wireshark-users] Support for RADIUS (RFC 3576, RFC3579, RFC3580)?
From: Bill Meier <wmeier@xxxxxxxxxxx>
Date: Wed, 30 Sep 2009 15:44:44 -0400
Bill Meier wrote:
Vikas Sarawat wrote:
WireShark Users,

Does any one know if WireShark (version 1.2.2) can decode attributes
specified in the following RADIUS extensions?

*	RFC 3576 - Dynamic Authorization Extensions to Remote
Authentication Dial In User Service (RADIUS)
*	RFC3579 - RADIUS (Remote Authentication Dial In User Service)
Support For Extensible Authentication Protocol (EAP)
*	RFC3580 - IEEE 802.1X Remote Authentication Dial In User Service
(RADIUS) Usage Guidelines


Although I've a limited knowledge of Radius I do note that Wireshark has Radius dictionary files for RFC3576 & RFC3580 and thus should be able to decode such attributes.

I don't see an explicit dictionary for RFC3579.

 From the Wireshark RADIUS README:

$cat README.radius_dictionary
[Jul-09-2009]

As of the above date the dictionary files in this directory are those from the FreeRadius 2.1.6 [May-18-2009] release
with the following changes:

<snip>

---------
If you've downloaded Wireshark you can look in the wireshark.../radius directory to see all the available dictionary files and the complete README.

Bill Meier


Digging a little further: I do see that Wireshark does have a dictionary for RFC2869 which is apparently the predecessor for RFC3579.