RADIUS Log
Definition
An authentication, authorisation, and accounting record produced by a Remote Authentication Dial-In User Service server. Each entry records the username, authenticating device identifier, access point or network access server, timestamp, and result. Provides a named-account-to-network-location link that DHCP alone cannot supply.
- Protocol
- RADIUS, UDP ports 1812/1813
- Records
- Username, NAS/AP identifier, timestamp, session result
- Function
- Authentication, authorisation, accounting (AAA)
- Investigative use
- Links a named account to a physical access point
Common questions
Why is a RADIUS log more useful than a DHCP log alone?+
DHCP shows which IP address a device held, but not who was using it. RADIUS accounting ties that session to an authenticated username and the specific access point or NAS the login came through, so investigators can name a person, not just a device.
How long do organisations typically retain RADIUS logs?+
Retention varies widely by operator policy and jurisdiction, from a few weeks on small enterprise networks to longer periods for ISPs and carriers under regulatory or legal-hold obligations. Investigators should request preservation as early as possible.
Related terms
- DHCP Lease Log
- A record maintained by a Dynamic Host Configuration Protocol server that maps each IP address assignment to the requesting device's MAC address,...
- Intrusion Detection System (IDS)
- A network or host-based monitoring system that analyses traffic or system behaviour against a rule set (signature-based) or a statistical baseline (anomaly-based)...
- NetFlow
- A network protocol (originally Cisco, now standardised as IPFIX under RFC 7011) that records metadata about IP traffic flows: source and destination...
- PCAP (Packet Capture)
- A file format (and the process of creating it) that records every byte of every network packet passing a capture point, including...
- Syslog
- A standardised protocol (RFC 5424) for transmitting log messages from network devices to a centralised log server. Routers, switches, firewalls, and servers...