RADIUS Attributes Reference
Searchable reference of the standard RADIUS attributes and the vendor-specific attributes that matter in ISP and enterprise deployments.
Result
Standard attributes shown
41 of 41
Vendor attributes shown
10 of 10
Standard attributes (RFC 2865 / 2866 / 3162 / 4818)
| # | Attribute | Type | Used in | Notes |
|---|---|---|---|---|
| 1 | User-Name | string | Request | The identity being authenticated - a PPPoE login, a MAC address for MAB, or an EAP identity. |
| 2 | User-Password | string | Request | PAP password, obfuscated with MD5 against the shared secret. Not encryption. |
| 3 | CHAP-Password | octets | Request | CHAP response; requires the server to hold the cleartext password. |
| 4 | NAS-IP-Address | ipaddr | Request | Address of the NAS sending the request - must match a clients.conf entry. |
| 5 | NAS-Port | integer | Request | Physical or virtual port number on the NAS. |
| 6 | Service-Type | integer | Both | Framed-User for PPP/DHCP subscribers, Login-User for shell, Call-Check for MAB. |
| 7 | Framed-Protocol | integer | Both | PPP (1) for PPPoE sessions. |
| 8 | Framed-IP-Address | ipaddr | Reply | Static address handed to the session. 255.255.255.254 means "assign from NAS pool". |
| 9 | Framed-IP-Netmask | ipaddr | Reply | Netmask for the framed address. |
| 11 | Filter-Id | string | Reply | Names an ACL or filter already defined on the NAS. |
| 12 | Framed-MTU | integer | Reply | MTU for the session - 1492 on PPPoE. |
| 18 | Reply-Message | string | Reply | Human-readable text; some NAS platforms display it to the user on reject. |
| 22 | Framed-Route | string | Reply | Route to install pointing at this session - used for routed CPE. |
| 24 | State | octets | Both | Opaque value binding multi-round EAP exchanges together. |
| 25 | Class | octets | Both | Server-supplied opaque value echoed back in accounting - the correct way to correlate auth with accounting. |
| 26 | Vendor-Specific | octets | Both | Container for VSAs such as Mikrotik-Rate-Limit or Cisco-AVPair. |
| 27 | Session-Timeout | integer | Reply | Seconds before the session is terminated. Used for prepaid and hotspot. |
| 28 | Idle-Timeout | integer | Reply | Seconds of inactivity before termination. |
| 29 | Termination-Action | integer | Reply | RADIUS-Request (1) triggers reauthentication instead of disconnect at timeout. |
| 30 | Called-Station-Id | string | Request | NAS-side identifier - on WiFi, the AP MAC plus SSID. |
| 31 | Calling-Station-Id | string | Request | Client-side identifier - the subscriber MAC address. |
| 32 | NAS-Identifier | string | Request | NAS name, an alternative to NAS-IP-Address. |
| 40 | Acct-Status-Type | integer | Accounting | Start (1), Stop (2), Interim-Update (3), Accounting-On (7), Accounting-Off (8). |
| 42 | Acct-Input-Octets | integer | Accounting | Bytes received from the subscriber - wraps at 4 GiB without the Gigawords companion. |
| 43 | Acct-Output-Octets | integer | Accounting | Bytes sent to the subscriber. |
| 44 | Acct-Session-Id | string | Accounting | Unique session identifier - the key for CoA and billing correlation. |
| 45 | Acct-Authentic | integer | Accounting | How the session was authenticated (RADIUS, Local, Remote). |
| 46 | Acct-Session-Time | integer | Accounting | Session duration in seconds. |
| 47 | Acct-Input-Packets | integer | Accounting | Packets received from the subscriber. |
| 49 | Acct-Terminate-Cause | integer | Accounting | Why the session ended - User-Request, Lost-Carrier, Idle-Timeout, Admin-Reset. |
| 52 | Acct-Input-Gigawords | integer | Accounting | High-order 32 bits of the input counter. Ignoring it undercounts every session past 4 GiB. |
| 53 | Acct-Output-Gigawords | integer | Accounting | High-order 32 bits of the output counter. |
| 61 | NAS-Port-Type | integer | Request | Ethernet (15), Wireless-802.11 (19), Virtual (5), xDSL variants. |
| 64 | Tunnel-Type | integer | Reply | VLAN (13) for dynamic VLAN assignment in 802.1X. |
| 65 | Tunnel-Medium-Type | integer | Reply | IEEE-802 (6) alongside Tunnel-Type for VLAN assignment. |
| 81 | Tunnel-Private-Group-Id | string | Reply | The VLAN ID itself in dynamic VLAN assignment. |
| 85 | Acct-Interim-Interval | integer | Reply | How often the NAS should send interim accounting updates, in seconds. |
| 87 | NAS-Port-Id | string | Request | Text port identifier - often the DSLAM or OLT circuit ID. |
| 88 | Framed-Pool | string | Reply | Name of an address pool defined on the NAS. |
| 97 | Framed-IPv6-Prefix | ipv6prefix | Reply | IPv6 prefix assigned to the link. |
| 123 | Delegated-IPv6-Prefix | ipv6prefix | Reply | Prefix delegated to the CPE for downstream networks - typically a /56. |
Vendor-specific attributes
| Vendor | Vendor ID | Attribute | Purpose |
|---|---|---|---|
| MikroTik | 14988 | Mikrotik-Rate-Limit (8) | rx/tx rate string controlling the subscriber queue. |
| MikroTik | 14988 | Mikrotik-Address-List (19) | Adds the session address to a named firewall address list. |
| MikroTik | 14988 | Mikrotik-Realm (10) | Realm string for PPP authentication. |
| MikroTik | 14988 | Mikrotik-Group (3) | Assigns the session to a RouterOS user group or PPP profile. |
| Cisco | 9 | Cisco-AVPair (1) | Generic name=value carrier: ip:qos-policy, subscriber:sub-qos-policy, shell:priv-lvl. |
| Cisco | 9 | h323-* attributes | Voice gateway billing attributes. |
| Juniper | 2636 | Unisphere-Ingress-Policy-Name (10) | Applies a named ingress policy to the subscriber (ERX/MX). |
| Juniper | 2636 | Juniper-Local-Group-Name (2) | Login class for administrative access. |
| WISPr | 14122 | WISPr-Bandwidth-Max-Down (8) | Vendor-neutral downstream rate in bit/s, honoured by many hotspot platforms. |
| Ubiquiti | 41112 | Unifi-VLAN (3) | VLAN assignment for UniFi access points. |
The Gigawords trap
Counters wrap: Acct-Input-Octets is 32 bits, so any session moving more than 4 GiB needs Acct-Input-Gigawords to be read alongside it. Billing systems that ignore Gigawords silently undercharge heavy users - and silently exonerate abusers.
About RADIUS Attributes Reference
RADIUS attributes are the vocabulary of AAA: what the NAS asks, what the server answers, and what accounting records carry. This is the working subset - the attributes that appear in real ISP and enterprise deployments, with notes on the behaviour that is not obvious from the RFC.
Where the interesting things live
Standard attributes cover identity, addressing and accounting. Everything vendor-specific - queue rates, QoS policy names, VLAN behaviour beyond the standard tunnel attributes - is carried inside attribute 26 (Vendor-Specific) as a VSA, keyed by an IANA vendor number. MikroTik is 14988, Cisco is 9, Juniper is 2636. Your server needs the matching dictionary loaded before it can send them by name.
Dynamic VLAN assignment
The standard combination is three attributes together: Tunnel-Type = VLAN (13), Tunnel-Medium-Type = IEEE-802 (6) and Tunnel-Private-Group-Id = <vlan>. All three are required - sending only the VLAN ID is the most common 802.1X misconfiguration, and most switches will simply ignore it.
Common use cases
- Checking which attribute a NAS expects for a feature before writing policy.
- Debugging an accounting record that does not line up with billing.
- Finding the right VSA for a vendor you have not deployed before.
Edge cases and gotchas
- Attribute names are dictionary-defined: a missing or mismatched dictionary makes the server send nothing rather than error loudly.
- Class (25) is the intended correlation key between auth and accounting - many implementations invent their own instead and regret it.
Frequently asked questions
Why do my accounting byte counts look too low?
The 32-bit octet counters wrapped. Read Acct-Input-Gigawords and Acct-Output-Gigawords and combine: total = gigawords x 2^32 + octets.
How do I assign a VLAN from RADIUS?
Send Tunnel-Type = VLAN, Tunnel-Medium-Type = IEEE-802 and Tunnel-Private-Group-Id = the VLAN ID, all with the same tag value. All three are required.