RADIUS

RADIUS is an AAA protocol defined by the IETF in RFC 2865 (authentication) and RFC 2866 (accounting). The device that serves the user directly acts as the RADIUS client (NAS). That can be a BNG, a PPPoE server, a hotspot router or a wireless access point. The NAS forwards the user's credentials to the server in an Access-Request packet. The server checks its subscriber database and answers with Access-Accept or Access-Reject, or with Access-Challenge when another verification step is needed.

Along with granting access, an Access-Accept carries attributes such as the IP address to assign (Framed-IP-Address), the session limit (Session-Timeout) and the speed profile. Vendor-specific attributes (VSAs) extend this, for example Mikrotik-Rate-Limit to push a bandwidth limit to a MikroTik router. Accounting-Request packets are sent at session start, at regular intervals (Interim-Update) and at session stop. They record duration, uploaded/downloaded bytes and IP details, which feed billing and legal record-keeping.

RADIUS traditionally uses UDP ports 1812 (authentication) and 1813 (accounting). CoA (Change of Authorization) and Disconnect-Message, defined in RFC 5176, let operators change the speed profile of a live session or terminate it. This is how a subscriber is throttled once a quota is used up. The MD5-based shared-secret design is considered weak. Especially after the BlastRADIUS vulnerability (CVE-2024-3596) disclosed in 2024, the Message-Authenticator attribute should be enforced and RADIUS traffic should preferably travel over TLS (RadSec) or an encrypted tunnel.

ISPs use RADIUS to authenticate PPPoE and IPoE subscribers, apply plan-based speed and quota rules and keep subscriber session records. In collective-use locations such as hotels, cafés and schools, guests who log in through a captive portal are also managed via RADIUS. Much of the access data retained under Turkish Law No. 5651 is derived from its accounting records.