Skip site navigation (1)Skip section navigation (2)

FreeBSD Manual Pages


home | help
RADCLIENT(1)		       FreeRADIUS Daemon		  RADCLIENT(1)

       radclient - send	packets	to a RADIUS server, show reply

       radclient  [-4] [-6] [-c	count] [-d raddb_directory] [-D	dictionary_di-
       rectory]	[-f file] [-F] [-h] [-i	id] [-n	 num_requests_per_second]  [-p
       num_requests_in_parallel]  [-q]	[-r  num_retries]  [-s]	[-S shared_se-
       cret_file] [-t timeout] [-v] [-x] server	 {acct|auth|status|coa|discon-
       nect|auto} secret

       radclient  is  a	 radius	 client	 program. It can send arbitrary	radius
       packets to a radius server, then	shows the reply. It  can  be  used  to
       test  changes you made in the configuration of the radius server, or it
       can be used to monitor if a radius server is up.

       radclient reads radius attribute/value pairs from it standard input, or
       from a file specified on	the command line. It then encodes these	attri-
       bute/value pairs	using the dictionary, and sends	 them  to  the	remote

       The  User-Password  and	CHAP-Password attributes are automatically en-
       crypted before the packet is sent to the	server.

       -4     Use IPv4 (default)

       -6     Use IPv6

       -c count
	      Send each	packet count times.

       -d raddb_directory
	      The directory that contains the user dictionary  file.  Defaults
	      to /usr/local/share/examples/freeradius/raddb.

       -D dictionary_directory
	      The  directory  that contains the	main dictionary	file. Defaults
	      to /usr/share/freeradius.

       -f file[:file]
	      File to read the attribute/value pairs  from.  If	 this  is  not
	      specified,  they are read	from stdin.  This option can be	speci-
	      fied multiple times, in which case packets are sent in order  by
	      file,  and  within each file, by first packet to last packet.  A
	      blank line separates logical packets within a file.  If  a  pair
	      of files separated by a colon is specified, the second file will
	      be used to filter	the responses to requests from the first.  The
	      number  of  requests and filters must be the same.  A summary of
	      filter results will be displayed if -s is	passed.

       -F     Print the	file name, packet number and reply code.

       -h     Print usage help information.

       -i id  Use id as	the RADIUS request Id.

       -n num_requests_per_second
	      Try to send num_requests_per_second, evenly spaced.  This	option
	      allows  you  to  slow down the rate at which radclient sends re-
	      quests.  When not	using -n, the default is to  send  packets  as
	      quickly as possible, with	no inter-packet	delays.

	      Due to limitations in radclient, this option does	not accurately
	      send the requested number	of packets per second.

       -p num_requests_in_parallel
	      Send num_requests_in_parallel, without waiting  for  a  response
	      for  each	one.  By default, radclient sends the first request it
	      has read,	waits for the response,	and once the response  is  re-
	      ceived,  sends  the second request in its	list.  This option al-
	      lows you to send many requests at	simultaneously.	 Once  num_re-
	      quests_in_parallel  are sent, radclient waits for	all of the re-
	      sponses to arrive	(or for	the  requests  to  time	 out),	before
	      sending any more packets.

	      This option permits you to discover the maximum load accepted by
	      a	RADIUS server.

       -P proto
	      Use proto	transport protocol ("tcp" or "udp").   Only  available
	      if FreeRADIUS is compiled	with TCP transport support.

       -q     Go to quiet mode,	and do not print out anything.

       -r num_retries
	      Try  to  send each packet	num_retries times, before giving up on
	      it.  The default is 10.

       -s     Print out	some summaries of packets sent and received.

       -S shared_secret_file
	      Rather than reading the  shared  secret  from  the  command-line
	      (where  it  can  be seen by others on the	local system), read it
	      instead from shared_secret_file.

       -t timeout
	      Wait timeout seconds before deciding that	the NAS	 has  not  re-
	      sponded  to  a  request, and re-sending the packet.  The default
	      timeout is 3.

       -v     Print out	version	information.

       -x     Print out	debugging information.

	      The hostname or IP address of the	remote	server.	 Optionally  a
	      UDP  port	 can  be specified. If no UDP port is specified, it is
	      looked up	in /etc/services.  The	service	 name  looked  for  is
	      radacct  for  accounting	packets,  and radius for all other re-
	      quests. If a service is not found	 in  /etc/services,  1813  and
	      1812  are	 used  respectively.   For coa and disconnect packets,
	      port 3799	is used.

	      If a host	name is	 specified,  then  radclient  will  do	a  DNS
	      lookup,  and  use	the A record to	find the IP address of the RA-
	      DIUS server.  If there is	no A record, then radclient will  look
	      for  an  AAAA record.  If	there is no AAAA record, an error will
	      be produced.

	      IPv6 addresses may be specified  by  surrounding	it  in	square
	      brackets.	  For  example,	 [2002:c000:0201:0:0:0:0:0], or	with a
	      port, [2002:c000:0201:0:0:0:0:0]:18120.

	      The RADIUS attributes read by radclient can contain the  special
	      attribute	Packet-Dst-IP-Address.	If this	attribute exists, then
	      that IP address is where the packet  is  sent,  and  the	server
	      specified	on the command-line is ignored.

	      If  the RADIUS attribute list always contains the	Packet-Dst-IP-
	      Address attribute, then the server parameter can be given	as -.

	      The RADIUS attributes read by radclient can contain the  special
	      attribute	 Packet-Dst-Port.  If this attribute exists, then that
	      UDP port is where	the packet is sent, and	the :port specified on
	      the command-line is ignored.

       acct | auth | status | coa | disconnect | auto
	      Use auth to send an authentication packet	(Access-Request), acct
	      to send an accounting  packet  (Accounting-Request),  status  to
	      send  a  status packet (Status-Server), or coa to	send a CoA-Re-
	      quest, or	disconnect to send a disconnection request. Instead of
	      these values, you	can also use a decimal code here. For example,
	      code 12 is also Status-Server.

	      The RADIUS attributes read by radclient can contain the  special
	      attribute	Packet-Type.  If this attribute	exists,	then that type
	      of packet	is sent, and the type specified	on the command-line is

	      If the RADIUS attribute list always contains the Packet-Type at-
	      tribute, then the	type parameter can be given as auto.

       secret The shared secret	for this client.  It needs to  be  defined  on
	      the  radius  server side too, for	the IP address you are sending
	      the radius packets from.

       A sample	session	that queries the remote	server for Status-Server  (not
       all  servers  support this, but FreeRADIUS has configurable support for

	      $	echo "Message-Authenticator = 0x00" | radclient status s3cr3t
	      Sending request to server, port 1812.
	      radrecv: Packet from host code=2, id=140, length=54
		  Reply-Message	= "FreeRADIUS up 21 days, 02:05"


       Miquel van Smoorenburg,  Alan DeKok	<aland@freera->

				 22 March 2019			  RADCLIENT(1)


Want to link to this manual page? Use this URL:

home | help