The default probe uses the following string to query the radius server, problem is nobody seems to know how this string is structured
From what I understand, the string is sent as a username/password set somehow which effectively does a login to the radius box, and the return from that login is then checked by the receive field which is set to "\x03D" in the default probe.
If you can play around with these bits of info you would be able to get it to work
I gave up trying to get it to work, but I'm sure it would with the right info
I hope that helps, please post if you figure it out