dhcp server accounting radius - important info missing

RouterOS General
1

Hello,

I am looking freeradius with mikrotik dhcp server, interim-update is working but important details missing:

here is a mikrotik pppoe accounting request:

22:30:32 radius,debug sending 1b:00 to 172.16.36.251:1813 
22:30:32 radius,debug,packet sending Accounting-Request with id 178 to 172.16.36.251:1813 
22:30:32 radius,debug,packet     Signature = 0xc113ef16228c3ea68d28f795de4e4636 
22:30:32 radius,debug,packet     Service-Type = 2 
22:30:32 radius,debug,packet     Framed-Protocol = 1 
22:30:32 radius,debug,packet     NAS-Port = 15763294 
22:30:32 radius,debug,packet     NAS-Port-Type = 15 
22:30:32 radius,debug,packet     User-Name = "user301" 
22:30:32 radius,debug,packet     Calling-Station-Id = "98:35:ED:DB:A7:4B" 
22:30:32 radius,debug,packet     Called-Station-Id = "PPPOE26" 
22:30:32 radius,debug,packet     NAS-Port-Id = "vlan26" 
22:30:32 radius,debug,packet     Acct-Session-Id = "812086bc" 
22:30:32 radius,debug,packet     Framed-IP-Address = 10.100.0.250 
22:30:32 radius,debug,packet     Acct-Authentic = 1 
22:30:32 radius,debug,packet     Event-Timestamp = 1741123832 
22:30:32 radius,debug,packet     Acct-Session-Time = 322201 
22:30:32 radius,debug,packet     Idle-Timeout = 0 
22:30:32 radius,debug,packet     Session-Timeout = 2708532 
22:30:32 radius,debug,packet     Acct-Input-Octets = 19966527 
22:30:32 radius,debug,packet     Acct-Input-Gigawords = 0 
22:30:32 radius,debug,packet     Acct-Input-Packets = 191141 
22:30:32 radius,debug,packet     Acct-Output-Octets = 47192887 
22:30:32 radius,debug,packet     Acct-Output-Gigawords = 0 
22:30:32 radius,debug,packet     Acct-Output-Packets = 136413 
22:30:32 radius,debug,packet     Acct-Status-Type = 3 
22:30:32 radius,debug,packet     NAS-Identifier = "MikroTik" 
22:30:32 radius,debug,packet     Acct-Delay-Time = 0 
22:30:32 radius,debug,packet     NAS-IP-Address = 172.16.36.1 
22:30:32 radius,debug,packet received Accounting-Response with id 178 from 172.16.36.251:1813 
22:30:32 radius,debug,packet     Signature = 0xac9188c577d14cde5cd80227787c5636

and here is mikrotik dhcp accounting request:

2025-03-04 22:24:10 radius,debug,packet sending Accounting-Request with id 222 to 172.16.166.21:1813
 2025-03-04 22:24:10 radius,debug,packet     Signature = 0xadff6af2a4d11fed9fea88252c4906fa
 2025-03-04 22:24:10 radius,debug,packet     User-Name = "20:3D:B2:A9:BD:25"
 2025-03-04 22:24:10 radius,debug,packet     NAS-Port-Type = 15
 2025-03-04 22:24:10 radius,debug,packet     NAS-Port = 20
 2025-03-04 22:24:10 radius,debug,packet     NAS-Port-Id = "vlan526"
 2025-03-04 22:24:10 radius,debug,packet     Service-Type = 2
 2025-03-04 22:24:10 radius,debug,packet     Calling-Station-Id = "xhiksi_IMATH"
 2025-03-04 22:24:10 radius,debug,packet     Framed-IP-Address = 172.16.210.22
 2025-03-04 22:24:10 radius,debug,packet     Called-Station-Id = "dhcp3"
 2025-03-04 22:24:10 radius,debug,packet     Unknown-Attribute(vendor=Redback, type=97) = 0x30332031302e31302e37302e33203620
 2025-03-04 22:24:10 radius,debug,packet       2320302023203130
 2025-03-04 22:24:10 radius,debug,packet     ADSL-Agent-Circuit-ID = "03 10.10.70.3 6 # 0 # 10"
 2025-03-04 22:24:10 radius,debug,packet     Event-Timestamp = 1741123450
 2025-03-04 22:24:10 radius,debug,packet     Acct-Status-Type = 3
 2025-03-04 22:24:10 radius,debug,packet     Acct-Session-Id = "83e00003"
 2025-03-04 22:24:10 radius,debug,packet     Acct-Authentic = 1
 2025-03-04 22:24:10 radius,debug,packet     Acct-Session-Time = 85801
 2025-03-04 22:24:10 radius,debug,packet     NAS-Identifier = "MikroTik"
 2025-03-04 22:24:10 radius,debug,packet     Acct-Delay-Time = 0
 2025-03-04 22:24:10 radius,debug,packet     NAS-IP-Address = 172.16.166.1
 2025-03-04 22:24:10 radius,debug,packet received Accounting-Response with id 222 from 172.16.166.21:1813

as we cans see Acct-Input-Octets, Acct-Input-Packets , Acct-Output-Octets , Acct-Output-Packets are not included in dhcp. I am hoping that it is not definitive, what does mean accounting without traffic statistics ?

2

any answer ? please help!

Has any tried dhcp with radius to build a working aaa system ?

Another problem I found while playing, it is: all dhcp servers send accounting requests to radius even its own ‘Use Radius’ is set to ‘no’.

This seems a bug.

3

I think the data is not available because the DHCP server does not keep track of such information (packet and byte counters) for each lease. It’s also logical that it cannot do that because normally traffic between devices on the same layer 2 (same subnet) is not visible to the router, only to the switch(es) they are connected to. Even if two devices are connected directly to the router, if they are in the same subnet then normally only the switching (layer 2) part of the router’s bridge is used when the devices talk to each other. At most the router can only count the IP traffic that uses it (the router) as the gateway, but it currently doesn’t do that per individual lease. If you open a lease under IP → DHCP Server → Leases, you’ll see that traffic information is not tracked. Which means there is nothing that can be added to the accounting packets.

With PPPoE all communication on the PPPoE link must go through the access concentrator (aka the PPPoE server), which is the router itself. Which means it can count all the bytes and packets and does track such information (visible on the Traffic tab when you open a PPP interface). That’s why such information can be included in the RADIUS accounting (interim) packets.

4

Queue is needed for accounting, and it is added only if rate limit is non-empty.

5

Yes, it is true, traffic counters return if make the lease as static and add rate limit.
But in this case only, in which a dynamic queue is added.

I tried without success without success, making lease static, adding queue by script to that ip with same name format no luck.

Static lease has a big problem: It prevents mikrotik to send access request to radius when Session-Timeout finishes.

Dynamic lease have not counters on start, interim-update, stop accounting requests, but it lets mikrotik sending an access-request to radius when Session-Timeout finishes.

Has anyone has to do with these features ? are them documented ? their behaviors seem arbitrary eg:

when dynamic leases sends an access-request to radius in the middle of Session-Timeout, this causes excessive unnecessary logins every half.
example during last hour there are ln3600 logins instead of one only at wanted time.

this has a kind of workaround in freeradius duplicating Session-Timeout.

Is anyway to add queues for counters without making queues static ? in order to make all features working