Audit PPPoE Sessions Using RADIUS Accounting and Logs
PPPoE operators must routinely audit RADIUS authentication and accounting to catch incomplete sessions that cause billing errors. Learn the failure patterns, validation steps, and how ISPbills radacct records and post-au
PPPoE operators must routinely audit RADIUS authentication and accounting to catch incomplete sessions that cause billing errors. Learn the failure patterns, validation steps, and how ISPbills radacct records and post-au
PPPoE deployments rely on RADIUS for subscriber authentication, authorization, and accounting, but network drops, NAS glitches, or policy mismatches often leave incomplete radacct records or silent auth failures. This leads to underbilled usage, support overload, and trust erosion. A repeatable audit pattern detects these issues early, with defined failure indicators and validation checks.
RADIUS Flow for PPPoE Sessions
In a standard PPPoE RADIUS exchange, the NAS sends an Access-Request with username and attributes like Called-Station-ID. The server responds with Access-Accept (or Reject) including session timeouts and rate-limits. Accounting follows: Acct-Status-Type=Start captures connect time, Interim-Update reports usage, and Stop logs disconnect with final bytes. FreeRADIUS logs these in post-auth and radacct tables. Deviations here signal operational risks.
Common PPPoE RADIUS Failure Modes
Authentication Rejects
Access-Reject without post-auth log entry indicates credential expiry or lockout. Subscribers report login loops; billing sees no usage.
Missing Acct-Start
Access-Accept granted but no Start record. Often NAS buffer overflow; sessions run unbilled.
Gapped Interim Updates
Start present, but no usage reports for hours. Policy misfire or RADIUS timeout; inflates actual consumption.
Incomplete Acct-Stop
Start without Stop after timeout. Zombie sessions skew capacity planning and revenue.
Practical Validation Steps
- Query radacct table for a 24-hour window: SELECT COUNT(*) FROM radacct WHERE AcctStartTime > NOW() – INTERVAL 1 DAY GROUP BY username HAVING COUNT(AcctStopTime) < COUNT(*);
- Match anomalies against post-auth logs: grep for username Access-Accept timestamps to confirm NAS delivery.
- Calculate completeness: (Stops / Starts) > 99% per NAS; flag if below.
- Validate usage totals: Sum AcctInputOctets + AcctOutputOctets against interim gaps.
- For orphans, issue Disconnect-Message CoA with Event-Timestamp; confirm NAS response in logs.
Audit PPPoE Access with ISPbills
ISPbills centralizes FreeRADIUS NAS and policy management, exposing radacct session records alongside post-authentication logs for PPPoE and Hotspot authentication. Operators verify session completeness by querying unified records, cross-checking auth grants against accounting starts. CoA support enables targeted session termination for failures. Billing teams gain simpler handoffs: export validated reports showing 99%+ match rates, reducing disputes. Confirm your FreeRADIUS version integrates via ISPbills NAS config, and test CoA on a staging NAS before production. Pricing and feature availability can change; check the current feature page.
Your PPPoE Audit Decision Framework
Adopt this standard: Run daily audits; pass if auth success > 98% and acct-complete > 99%. Failure triggers tiered response—log review for <99%, full NAS reboot for <95%, after validating configs and local regulations. Next action: Sample 100 recent radacct entries against logs today. Automate thresholds in scripts, halting billing exports on fails until resolved. This pattern scales with subscriber growth, tying access evidence to operations.
Research basis: ISPbills product documentation; FreeRADIUS documentation. Validate implementation details against the software releases, contracts, configurations, and local regulations governing your network.