Troubleshooting Tip: Debugging RADIUS authentication issues on the FortiAP WiFi

[vpatil]

Description	This article describes the steps to debug RADIUS authentication issues when connecting Wireless clients to WPA2 or WPA3 Enterprise RADIUS SSIDs on the FortiAP WiFi managed by FortiGate Firewall.
Scope	FortiAP and FortiGate v7.4 and v7.6.
Solution	Perform the following checks to determine if this is a FortiAP or FortiGate, or an External RADIUS Server, or a WiFi client-side issue: Consider whether this is a new setup or if, before this issue, the RADIUS authentication ever worked fine on the WiFi clients. If this is an existing & working setup, consider whether there was any change made (config changes or firmware upgrade) on the FortiAP/FortiGate/Network/External RADIUS Server before this issue. Verify the Server Certificate is still valid on the External RADIUS Server by checking its expiry date. On the FortiGate, verify whether the connectivity between the FortiGate and the RADIUS server is successful. The 'Test connectivity' connection status should be successful: Troubleshooting Tip: RADIUS authentication troubleshooting If the connectivity between the FortiGate and the RADIUS Server fails, it is not a FortiAP WiFi issue. The issue should be investigated on the FortiGate Firewall and the External RADIUS Server: Verify whether the FortiGate IP address (NAS) is added as a 'RADIUS Client' on the External RADIUS Server. Additionally, verify whether the RADIUS shared secret key/passphrase matches on both the FortiGate and the External RADIUS server.  Validate the SSID (WPA2-Enterprise or WPA3-Enterprise) config on the FortiGate: Configuring WPA2-Enterprise SSID: Configuring WPA2-Enterprise SSID Configuring WPA3-Enterprise Only SSID: WPA3 Security Configuring WiFi with WSSO using Windows NPS and user groups: Configuring WiFi with WSSO using Windows NPS and user groups. After upgrading FortiGate to v7.4.4 or higher, WiFi users may fail to authenticate against the LDAP Server: this is a known issue on the FortiGate Firewall. For the solution, refer to Technical Tip: LDAPS STARTTLS certificate issuer enforcement. On the FortiGate CLI, gather the station logs in the problem state for the affected WiFi station MAC address to see if there are any RADIUS Access Request/Challenge/Accept/Reject messages seen in the logs: diagnose wireless-controller wlac sta_filter clear diagnose debug reset  diagnose wireless-controller wlac sta_filter <STA MAC> 255 diagnose debug console timestamp en diagnose debug enable After collecting the logs, disable the logging using the following commands: diagnose debug reset diagnose debug disable diagnose wireless-controller wlac sta_filter clear For more detailed RADIUS authentication logs, collect station-logs and wpad7 debug logs on the FortiGate CLI:  diagnose debug reset diagnose wireless-controller wlac sta_filter clear diagnose wireless-controller wlac sta_filter <STA MAC> 255 diagnose debug application wpad 7 diagnose debug console timestamp enable diagnose debug enable Reproduce the issue a couple of times, and after collecting the logs, disable the logs: diagnose debug disable diagnose, debug reset At the same time, also collect RADIUS packet captures for UDP ports 1812, 1813 on the FortiGate Interface where the External RADIUS Server is connected. The RADIUS captures can be collected on the FortiGate GUI: Troubleshooting Tip: Packet Capture on FortiOS GUI. If there is any RADIUS Reject message in the logs or captures, the reject reason will be mentioned. Additionally, obtain a screenshot of the RADIUS Reject reason seen on the External RADIUS Server. Log a new Fortinet Support Ticket and attach these logs and captures, as well as fap-tech, klog, and the FortiGate config files to the ticket for analysis. See Technical Tip: How to collect logs and config to assist TAC in debugging issues on FortiAP WiFi. The following are the sample logs that are collected in a working state when a WiFi client is successfully authenticated to WPA3-Enterprise SSID against the External RADIUS Server (FortiGuest): Sample station logs from FortiGate CLI: FortiWiFi-80F-2R # diagnose wireless-controller wlac sta_filter clear STA Filter is empty FortiWiFi-80F-2R # diagnose wireless-controller wlac sta_filter 96:69:B4:1E:93:92 255 STA Filter Index 0/1 sta 96:69:b4:1e:93:92 log-enabled 255 FortiWiFi-80F-2R # diagnose debug console timestamp enable FortiWiFi-80F-2R # diagnose debug enable FortiWiFi-80F-2R # 2025-06-06 07:28:33 93371.440 763 96:69:b4:1e:93:92 <ih> IEEE 802.11 mgmt::auth <== 96:69:b4:1e:93:92 ws (0-22.22.22.6:5246) vap TKM-WPA3 rId 0 wId 0 78:18:ec:99:1b:70 2025-06-06 07:28:33 93371.440 763 96:69:b4:1e:93:92 <ih> IEEE 802.11 mgmt::auth ==> 96:69:b4:1e:93:92 ws (0-22.22.22.6:5246) vap TKM-WPA3 rId 0 wId 0 78:18:ec:99:1b:70 2025-06-06 07:28:33 93371.443 763 96:69:b4:1e:93:92 <ih> IEEE 802.11 mgmt::assoc_req <== 96:69:b4:1e:93:92 ws (0-22.22.22.6:5246) vap TKM-WPA3 rId 0 wId 0 78:18:ec:99: 1b:70 2025-06-06 07:28:33 93371.443 763 96:69:b4:1e:93:92 <ih> 96:69:b4:1e:93:92 sta = 0xa6f62b0, sta->flags = 0x00000001, auth_alg = 0, hapd->splitMac: 1 2025-06-06 07:28:33 93371.444 763 96:69:b4:1e:93:92 cw_sta_load_chk ws (0-22.22.22.6:5246) rId 0 wId 0 sta 96:69:b4:1e:93:92 2025-06-06 07:28:33 93371.444 763 96:69:b4:1e:93:92 cw_sta_balancing: ws (0-22.22.22.6:5246) 96:69:b4:1e:93:92 enters balancing, rId 0, wId 0, fho 0, apho 0, 5G 0, sta _cnt 0, sta_th 55 2025-06-06 07:28:33 93371.444 763 96:69:b4:1e:93:92 cw_sta_balancing: ws (0-22.22.22.6:5246) 96:69:b4:1e:93:92 exits balancing, no need 2025-06-06 07:28:33 93371.444 763 96:69:b4:1e:93:92 <dc> STA add 96:69:b4:1e:93:92 vap TKM-WPA3 ws (0-22.22.22.6:5246) rId 0 wId 0 bssid 78:18:ec:99:1b:70 NON-AUTH b and 0x2020 mimo 2*2 2025-06-06 07:28:33 93371.444 763 96:69:b4:1e:93:92 <cc> STA_CFG_REQ(75) sta 96:69:b4:1e:93:92 add ==> ws (0-22.22.22.6:5246) rId 0 wId 0 2025-06-06 07:28:33 93371.444 763 96:69:b4:1e:93:92 <cc> STA add 96:69:b4:1e:93:92 vap TKM-WPA3 ws (0-22.22.22.6:5246) rId 0 wId 0 78:18:ec:99:1b:70 sec WPA3 ONLY ENTE RPRISE auth 0 2025-06-06 07:28:33 93371.444 763 96:69:b4:1e:93:92 cwAcStaRbtAdd: I2C_STA_ADD insert sta 96:69:b4:1e:93:92 22.22.22.6/0/0/1 2025-06-06 07:28:33 93371.445 763 96:69:b4:1e:93:92 <ih> IEEE 802.11 mgmt::assoc_resp ==> 96:69:b4:1e:93:92 ws (0-22.22.22.6:5246) vap TKM-WPA3 rId 0 wId 0 78:18:ec:99 :1b:70 2025-06-06 07:28:33 93371.445 763 96:69:b4:1e:93:92 <cc> STA_CFG_RESP(75) 96:69:b4:1e:93:92 <== ws (0-22.22.22.6:5246) rc 0 (Success) 2025-06-06 07:28:33 20113.445 96:69:b4:1e:93:92 <eh> ***96:69:b4:1e:93:92 AUTH_PAE DISCONNECTED*** 2025-06-06 07:28:33 20113.446 96:69:b4:1e:93:92 <eh> send IEEE 802.1X ver=2 type=0 (EAP_PACKET) data len=10 2025-06-06 07:28:33 20113.446 96:69:b4:1e:93:92 <eh> IEEE 802.1X (EAPOL 14B) ==> 96:69:b4:1e:93:92 ws (0-22.22.22.6:5246) rId 0 wId 0 78:18:ec:99:1b:70 2025-06-06 07:28:34 20114.089 96:69:b4:1e:93:92 <eh> IEEE 802.1X (EAPOL 8B) <== 96:69:b4:1e:93:92 ws (0-22.22.22.6:5246) rId 0 wId 0 78:18:ec:99:1b:70 2025-06-06 07:28:34 20114.089 96:69:b4:1e:93:92 <eh> recv IEEE 802.1X ver=1 type=1 (EAPOL_START) data len=0 2025-06-06 07:28:34 20114.090 96:69:b4:1e:93:92 <eh> send IEEE 802.1X ver=2 type=0 (EAP_PACKET) data len=10 2025-06-06 07:28:34 20114.090 96:69:b4:1e:93:92 <eh> IEEE 802.1X (EAPOL 14B) ==> 96:69:b4:1e:93:92 ws (0-22.22.22.6:5246) rId 0 wId 0 78:18:ec:99:1b:70 2025-06-06 07:28:34 20114.095 96:69:b4:1e:93:92 <eh> IEEE 802.1X (EAPOL 16B) <== 96:69:b4:1e:93:92 ws (0-22.22.22.6:5246) rId 0 wId 0 78:18:ec:99:1b:70 2025-06-06 07:28:34 20114.095 96:69:b4:1e:93:92 <eh> recv IEEE 802.1X ver=1 type=0 (EAP_PACKET) data len=12 2025-06-06 07:28:34 20114.095 96:69:b4:1e:93:92 <eh> RADIUS message (type=0) ==> RADIUS Server code=1 (Access-Request) id=225 len=302 2025-06-06 07:28:34 20114.096 96:69:b4:1e:93:92 <eh> RADIUS message (type=0) <== RADIUS Server code=11 (Access-Challenge) id=225 len=64 2025-06-06 07:28:34 20114.097 96:69:b4:1e:93:92 <eh> send IEEE 802.1X ver=2 type=0 (EAP_PACKET) data len=6 2025-06-06 07:28:34 20114.097 96:69:b4:1e:93:92 <eh> IEEE 802.1X (EAPOL 10B) ==> 96:69:b4:1e:93:92 ws (0-22.22.22.6:5246) rId 0 wId 0 78:18:ec:99:1b:70 2025-06-06 07:28:34 20114.115 96:69:b4:1e:93:92 <eh> IEEE 802.1X (EAPOL 165B) <== 96:69:b4:1e:93:92 ws (0-22.22.22.6:5246) rId 0 wId 0 78:18:ec:99:1b:70 2025-06-06 07:28:34 20114.115 96:69:b4:1e:93:92 <eh> recv IEEE 802.1X ver=1 type=0 (EAP_PACKET) data len=161 2025-06-06 07:28:34 20114.115 96:69:b4:1e:93:92 <eh> RADIUS message (type=0) ==> RADIUS Server code=1 (Access-Request) id=226 len=469 2025-06-06 07:28:34 20114.117 96:69:b4:1e:93:92 <eh> RADIUS message (type=0) <== RADIUS Server code=11 (Access-Challenge) id=226 len=1246 2025-06-06 07:28:34 20114.118 96:69:b4:1e:93:92 <eh> send IEEE 802.1X ver=2 type=0 (EAP_PACKET) data len=1180 2025-06-06 07:28:34 20114.118 96:69:b4:1e:93:92 <eh> IEEE 802.1X (EAPOL 1184B) ==> 96:69:b4:1e:93:92 ws (0-22.22.22.6:5246) rId 0 wId 0 78:18:ec:99:1b:70 2025-06-06 07:28:34 20114.124 96:69:b4:1e:93:92 <eh> IEEE 802.1X (EAPOL 10B) <== 96:69:b4:1e:93:92 ws (0-22.22.22.6:5246) rId 0 wId 0 78:18:ec:99:1b:70 2025-06-06 07:28:34 20114.124 96:69:b4:1e:93:92 <eh> recv IEEE 802.1X ver=1 type=0 (EAP_PACKET) data len=6 2025-06-06 07:28:34 20114.124 96:69:b4:1e:93:92 <eh> RADIUS message (type=0) ==> RADIUS Server code=1 (Access-Request) id=227 len=314 2025-06-06 07:28:34 20114.125 96:69:b4:1e:93:92 <eh> RADIUS message (type=0) <== RADIUS Server code=11 (Access-Challenge) id=227 len=221 2025-06-06 07:28:34 20114.125 96:69:b4:1e:93:92 <eh> send IEEE 802.1X ver=2 type=0 (EAP_PACKET) data len=163 2025-06-06 07:28:34 20114.126 96:69:b4:1e:93:92 <eh> IEEE 802.1X (EAPOL 167B) ==> 96:69:b4:1e:93:92 ws (0-22.22.22.6:5246) rId 0 wId 0 78:18:ec:99:1b:70 2025-06-06 07:28:34 20114.146 96:69:b4:1e:93:92 <eh> IEEE 802.1X (EAPOL 140B) <== 96:69:b4:1e:93:92 ws (0-22.22.22.6:5246) rId 0 wId 0 78:18:ec:99:1b:70 2025-06-06 07:28:34 20114.146 96:69:b4:1e:93:92 <eh> recv IEEE 802.1X ver=1 type=0 (EAP_PACKET) data len=136 2025-06-06 07:28:34 20114.147 96:69:b4:1e:93:92 <eh> RADIUS message (type=0) ==> RADIUS Server code=1 (Access-Request) id=228 len=444 2025-06-06 07:28:34 20114.148 96:69:b4:1e:93:92 <eh> RADIUS message (type=0) <== RADIUS Server code=11 (Access-Challenge) id=228 len=115 2025-06-06 07:28:34 20114.148 96:69:b4:1e:93:92 <eh> send IEEE 802.1X ver=2 type=0 (EAP_PACKET) data len=57 2025-06-06 07:28:34 20114.148 96:69:b4:1e:93:92 <eh> IEEE 802.1X (EAPOL 61B) ==> 96:69:b4:1e:93:92 ws (0-22.22.22.6:5246) rId 0 wId 0 78:18:ec:99:1b:70 2025-06-06 07:28:34 20114.161 96:69:b4:1e:93:92 <eh> IEEE 802.1X (EAPOL 10B) <== 96:69:b4:1e:93:92 ws (0-22.22.22.6:5246) rId 0 wId 0 78:18:ec:99:1b:70 2025-06-06 07:28:34 20114.161 96:69:b4:1e:93:92 <eh> recv IEEE 802.1X ver=1 type=0 (EAP_PACKET) data len=6 2025-06-06 07:28:34 20114.162 96:69:b4:1e:93:92 <eh> RADIUS message (type=0) ==> RADIUS Server code=1 (Access-Request) id=229 len=314 2025-06-06 07:28:34 20114.163 96:69:b4:1e:93:92 <eh> RADIUS message (type=0) <== RADIUS Server code=11 (Access-Challenge) id=229 len=98 2025-06-06 07:28:34 20114.163 96:69:b4:1e:93:92 <eh> send IEEE 802.1X ver=2 type=0 (EAP_PACKET) data len=40 2025-06-06 07:28:34 20114.163 96:69:b4:1e:93:92 <eh> IEEE 802.1X (EAPOL 44B) ==> 96:69:b4:1e:93:92 ws (0-22.22.22.6:5246) rId 0 wId 0 78:18:ec:99:1b:70 2025-06-06 07:28:34 20114.169 96:69:b4:1e:93:92 <eh> IEEE 802.1X (EAPOL 47B) <== 96:69:b4:1e:93:92 ws (0-22.22.22.6:5246) rId 0 wId 0 78:18:ec:99:1b:70 2025-06-06 07:28:34 20114.169 96:69:b4:1e:93:92 <eh> recv IEEE 802.1X ver=1 type=0 (EAP_PACKET) data len=43 2025-06-06 07:28:34 20114.170 96:69:b4:1e:93:92 <eh> RADIUS message (type=0) ==> RADIUS Server code=1 (Access-Request) id=230 len=351 2025-06-06 07:28:34 20114.172 96:69:b4:1e:93:92 <eh> RADIUS message (type=0) <== RADIUS Server code=11 (Access-Challenge) id=230 len=104 2025-06-06 07:28:34 20114.172 96:69:b4:1e:93:92 <eh> send IEEE 802.1X ver=2 type=0 (EAP_PACKET) data len=46 2025-06-06 07:28:34 20114.172 96:69:b4:1e:93:92 <eh> IEEE 802.1X (EAPOL 50B) ==> 96:69:b4:1e:93:92 ws (0-22.22.22.6:5246) rId 0 wId 0 78:18:ec:99:1b:70 2025-06-06 07:28:34 20114.179 96:69:b4:1e:93:92 <eh> IEEE 802.1X (EAPOL 50B) <== 96:69:b4:1e:93:92 ws (0-22.22.22.6:5246) rId 0 wId 0 78:18:ec:99:1b:70 2025-06-06 07:28:34 20114.179 96:69:b4:1e:93:92 <eh> recv IEEE 802.1X ver=1 type=0 (EAP_PACKET) data len=46 2025-06-06 07:28:34 20114.180 96:69:b4:1e:93:92 <eh> RADIUS message (type=0) ==> RADIUS Server code=1 (Access-Request) id=231 len=354 2025-06-06 07:28:34 20114.248 96:69:b4:1e:93:92 <eh> RADIUS message (type=0) <== RADIUS Server code=11 (Access-Challenge) id=231 len=104 2025-06-06 07:28:34 20114.248 96:69:b4:1e:93:92 <eh> send IEEE 802.1X ver=2 type=0 (EAP_PACKET) data len=46 2025-06-06 07:28:34 20114.248 96:69:b4:1e:93:92 <eh> IEEE 802.1X (EAPOL 50B) ==> 96:69:b4:1e:93:92 ws (0-22.22.22.6:5246) rId 0 wId 0 78:18:ec:99:1b:70 2025-06-06 07:28:34 20114.255 96:69:b4:1e:93:92 <eh> IEEE 802.1X (EAPOL 50B) <== 96:69:b4:1e:93:92 ws (0-22.22.22.6:5246) rId 0 wId 0 78:18:ec:99:1b:70 2025-06-06 07:28:34 20114.255 96:69:b4:1e:93:92 <eh> recv IEEE 802.1X ver=1 type=0 (EAP_PACKET) data len=46 2025-06-06 07:28:34 20114.256 96:69:b4:1e:93:92 <eh> RADIUS message (type=0) ==> RADIUS Server code=1 (Access-Request) id=232 len=354 2025-06-06 07:28:34 20114.257 96:69:b4:1e:93:92 <eh> RADIUS message (type=0) <== RADIUS Server code=2 (Access-Accept) id=232 len=181 2025-06-06 07:28:34 20114.258 96:69:b4:1e:93:92 <eh> send IEEE 802.1X ver=2 type=0 (EAP_PACKET) data len=4 2025-06-06 07:28:34 20114.258 96:69:b4:1e:93:92 <eh> IEEE 802.1X (EAPOL 8B) ==> 96:69:b4:1e:93:92 ws (0-22.22.22.6:5246) rId 0 wId 0 78:18:ec:99:1b:70 2025-06-06 07:28:34 20114.258 96:69:b4:1e:93:92 <eh> send 1/4 msg of 4-Way Handshake 2025-06-06 07:28:34 20114.259 96:69:b4:1e:93:92 <eh> send IEEE 802.1X ver=2 type=3 (EAPOL_KEY) data len=117 replay cnt 1 2025-06-06 07:28:34 20114.259 96:69:b4:1e:93:92 <eh> IEEE 802.1X (EAPOL 121B) ==> 96:69:b4:1e:93:92 ws (0-22.22.22.6:5246) rId 0 wId 0 78:18:ec:99:1b:70 2025-06-06 07:28:34 20114.269 96:69:b4:1e:93:92 <eh> IEEE 802.1X (EAPOL 259B) <== 96:69:b4:1e:93:92 ws (0-22.22.22.6:5246) rId 0 wId 0 78:18:ec:99:1b:70 2025-06-06 07:28:34 20114.270 96:69:b4:1e:93:92 <eh> recv IEEE 802.1X ver=2 type=3 (EAPOL_KEY) data len=255 2025-06-06 07:28:34 20114.270 96:69:b4:1e:93:92 <eh> recv EAPOL-Key 2/4 Pairwise replay cnt 1 2025-06-06 07:28:34 20114.270 96:69:b4:1e:93:92 <eh> send 3/4 msg of 4-Way Handshake 2025-06-06 07:28:34 20114.271 96:69:b4:1e:93:92 <eh> send IEEE 802.1X ver=2 type=3 (EAPOL_KEY) data len=343 replay cnt 2 2025-06-06 07:28:34 20114.271 96:69:b4:1e:93:92 <eh> IEEE 802.1X (EAPOL 347B) ==> 96:69:b4:1e:93:92 ws (0-22.22.22.6:5246) rId 0 wId 0 78:18:ec:99:1b:70 2025-06-06 07:28:34 20114.275 96:69:b4:1e:93:92 <eh> IEEE 802.1X (EAPOL 99B) <== 96:69:b4:1e:93:92 ws (0-22.22.22.6:5246) rId 0 wId 0 78:18:ec:99:1b:70 2025-06-06 07:28:34 20114.276 96:69:b4:1e:93:92 <eh> recv IEEE 802.1X ver=2 type=3 (EAPOL_KEY) data len=95 2025-06-06 07:28:34 20114.276 96:69:b4:1e:93:92 <eh> recv EAPOL-Key 4/4 Pairwise replay cnt 2 2025-06-06 07:28:34 93371.276 763 96:69:b4:1e:93:92 <dc> STA chg 96:69:b4:1e:93:92 vap TKM-WPA3 ws (0-22.22.22.6:5246) rId 0 wId 0 bssid 78:18:ec:99:1b:70 AUTH 2025-06-06 07:28:34 93371.276 763 96:69:b4:1e:93:92 cwAcKernChgSta,6850 ws (0-22.22.22.6:5246) TKM-WPA3 96:69:b4:1e:93:92 ret 0 2025-06-06 07:28:34 93371.277 763 96:69:b4:1e:93:92 <cc> STA chg 96:69:b4:1e:93:92 vap TKM-WPA3 ws (0-22.22.22.6:5246) rId 0 wId 0 78:18:ec:99:1b:70 sec WPA3 ONLY ENTE RPRISE auth 1 ****** 2025-06-06 07:28:34 93371.277 763 96:69:b4:1e:93:92 <cc> STA_CFG_REQ(76) sta 96:69:b4:1e:93:92 add key (len=16) ==> ws (0-22.22.22.6:5246) rId 0 wId 0 2025-06-06 07:28:34 2025-06-06 07:28:34 93371.278 763 96:69:b4:1e:93:92 <cc> STA_CFG_RESP(76) 96:69:b4:1e:93:92 <== ws (0-22.22.22.6:5246) rc 0 (Success) 20114.278 96:69:b4:1e:93:92 <eh> ***pairwise key handshake completed*** (RSN) 2025-06-06 07:28:34 93372.381 763 96:69:b4:1e:93:92 <dc> DHCP Request server 0.0.0.0 <== host iPhone mac 96:69:b4:1e:93:92 ip 192.168.200.2 xId c04c3bf4 2025-06-06 07:28:34 93372.382 763 96:69:b4:1e:93:92 <dc> DHCP Ack server 192.168.200.1 ==> host mac 96:69:b4:1e:93:92 ip 192.168.200.2 mask 255.255.255.0 gw 192.168.2 00.1 xId c04c3bf4 2025-06-06 07:28:34 93372.382 763 96:69:b4:1e:93:92 cwAcAddWSSO mac 96:69:b4:1e:93:92 ip 192.168.200.2 usr 's@s.com' grp 'NULL' authed 1 2025-06-06 07:28:34 93372.383 763 96:69:b4:1e:93:92 cwAcAddWSSO mac 96:69:b4:1e:93:92 ip 192.168.200.2 usr 's@s.com' grp 'NULL' authed 1 Example wpad 7 logs from the FortiGate CLI: FortiWiFi-80F-2R # FortiWiFi-80F-2R # FortiWiFi-80F-2R # diagnose debug application wpad 7 Debug messages will be on for 30 minutes. FortiWiFi-80F-2R # diagnose debug console timestamp enable FortiWiFi-80F-2R # diagnose debug enable FortiWiFi-80F-2R # 2025-06-06 07:33:27 06809.016 2025-06-06 07:33:27 Reveived 104 bytes RADIUS message from authentication server 10.36.196.164:1812 by sock 15 2025-06-06 07:33:27 RADIUS message: code=11 (Access-Challenge) identifier=239 length=104 2025-06-06 07:33:27 Attribute 80 (Message-Authenticator) length=18 2025-06-06 07:33:27 Value: 2b44e4dc600dd542c27f1f216b37933f 2025-06-06 07:33:27 Attribute 79 (EAP-Message) length=48 2025-06-06 07:33:27 Value: 01f5002e1900170303002385d26c27a3b090514d8e427fde48e50f3897e81f37ccd136ae3ca9dd6f645787e20194 2025-06-06 07:33:27 Attribute 24 (State) length=18 2025-06-06 07:33:27 Value: b553f5a4b3a6ec0df038f77ef6fabab2 2025-06-06 07:33:27 06809.021 2025-06-06 07:33:27 STA 96:69:b4:1e:93:92 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.11 sec 2025-06-06 07:33:27 20407.021 96:69:b4:1e:93:92 <eh> RADIUS message (type=0) <== RADIUS Server code=11 (Access-Challenge) id=239 len=104 2025-06-06 07:33:27 RADIUS packet matching with station 96:69:b4:1e:93:92 2025-06-06 07:33:27 06809.022 2025-06-06 07:33:27 HOSTAPD: <0>22.22.22.6:5246<0-0> STA 96:69:b4:1e:93:92 IEEE 802.1X: decapsulated EAP packet (code=1 id=245 len=46) f rom RADIUS server: EAP-Request-unknown (25) 2025-06-06 07:33:27 EAP: EAP entering state AAA_RESPONSE 2025-06-06 07:33:27 EAP: getId: id=245 2025-06-06 07:33:27 EAP: EAP entering state SEND_REQUEST2 2025-06-06 07:33:27 EAP: EAP entering state IDLE2 2025-06-06 07:33:27 EAP: retransmit timeout 3 seconds (from dynamic back off; retransCount=0) 2025-06-06 07:33:27 IEEE 802.1X: <0>22.22.22.6:5246<0-0> 96:69:b4:1e:93:92 BE_AUTH entering state REQUEST 2025-06-06 07:33:27 06809.023 2025-06-06 07:33:27 HOSTAPD: <0>22.22.22.6:5246<0-0> STA 96:69:b4:1e:93:92 IEEE 802.1X: Sending EAP Packet (identifier 245) 2025-06-06 07:33:27 20407.023 96:69:b4:1e:93:92 <eh> send IEEE 802.1X ver=2 type=0 (EAP_PACKET) data len=46 2025-06-06 07:33:27 20407.023 96:69:b4:1e:93:92 <eh> IEEE 802.1X (EAPOL 50B) ==> 96:69:b4:1e:93:92 ws (0-22.22.22.6:5246) rId 0 wId 0 78:18:ec:99:1b:70 2025-06-06 07:33:27 06809.023 2025-06-06 07:33:27 HOSTAPD: <0>22.22.22.6:5246<0-0> sending E2C_8021X (196 bytes) to_ipc 1 children 0 2025-06-06 07:33:27 Sending data - hexdump(len=196): 2025-06-06 07:33:27 0000: 00 03 00 00 00 00 00 00 00 00 00 00 06 16 16 16 ................ 2025-06-06 07:33:27 0010: 7E 14 00 00 78 18 EC 99 1B 68 00 00 00 00 00 00 ~...x....h...... 2025-06-06 07:33:27 0020: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 2025-06-06 07:33:27 0030: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 2025-06-06 07:33:27 0040: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 2025-06-06 07:33:27 0050: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 2025-06-06 07:33:27 0060: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 2025-06-06 07:33:27 0070: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 2025-06-06 07:33:27 0080: 40 00 00 00 96 69 B4 1E 93 92 78 18 EC 99 1B 70 @....i....x....p 2025-06-06 07:33:27 0090: 88 8E 02 00 00 2E 01 F5 00 2E 19 00 17 03 03 00 ................ 2025-06-06 07:33:27 00a0: 23 85 D2 6C 27 A3 B0 90 51 4D 8E 42 7F DE 48 E5 #..l'...QM.B..H. 2025-06-06 07:33:27 00b0: 0F 38 97 E8 1F 37 CC D1 36 AE 3C A9 DD 6F 64 57 .8...7..6.<..odW 2025-06-06 07:33:27 00c0: 87 E2 01 94 .... 2025-06-06 07:33:27 06809.025 2025-06-06 07:33:27 HOSTAPD: <0>22.22.22.6:5246<0-0> sent E2C_8021X (196 bytes) to /tmp/cwCwAcSocket 2025-06-06 07:33:27 06809.029 2025-06-06 07:33:27 HOSTAPD: <0>22.22.22.6:5246<0-0> Received C2E_8021X (196 bytes) from /tmp/cwCwAcSocket 2025-06-06 07:33:27 Received data - hexdump(len=196): 2025-06-06 07:33:27 0000: 00 02 00 00 65 63 75 72 00 00 00 00 06 16 16 16 ....ecur........ 2025-06-06 07:33:27 0010: 7E 14 00 00 78 18 EC 99 1B 70 22 20 65 6E 63 72 ~...x....p" encr 2025-06-06 07:33:27 0020: 79 70 74 69 6F 6E 3D 22 41 45 53 22 20 73 69 67 yption="AES" sig 2025-06-06 07:33:27 0030: 6E 61 6C 3D 2D 37 32 20 6E 6F 69 73 65 3D 2D 39 nal=-72 noise=-9 2025-06-06 07:33:27 0040: 35 20 6C 69 76 65 3D 31 33 39 33 34 37 36 20 61 5 live=1393476 a 2025-06-06 07:33:27 0050: 67 65 3D 36 37 20 6F 6E 77 69 72 65 3D 6E 6F 20 ge=67 onwire=no 2025-06-06 07:33:27 0060: 64 65 74 65 63 74 69 6F 6E 6D 65 74 00 30 42 31 detectionmet.0B1 2025-06-06 07:33:27 0070: 00 00 00 00 06 78 18 EC 99 1B 70 00 04 D3 32 01 .....x....p...2. 2025-06-06 07:33:27 0080: 40 00 00 00 78 18 EC 99 1B 70 96 69 B4 1E 93 92 @...x....p.i.... 2025-06-06 07:33:27 0090: 88 8E 01 00 00 2E 02 F5 00 2E 19 00 17 03 03 00 ................ 2025-06-06 07:33:27 00a0: 23 20 24 99 03 BF EC 7D 76 6F FC 3B 36 AE F4 9E # $....}vo.;6... 2025-06-06 07:33:27 00b0: 17 71 AC 48 70 40 1C A2 B4 71 32 01 56 B0 65 A3 .q.Hp@...q2.V.e. 2025-06-06 07:33:27 00c0: C0 64 BD 8D .d.. 2025-06-06 07:33:27 20407.031 96:69:b4:1e:93:92 <eh> IEEE 802.1X (EAPOL 50B) <== 96:69:b4:1e:93:92 ws (0-22.22.22.6:5246) rId 0 wId 0 78:18:ec:99:1b:70 2025-06-06 07:33:27 IEEE 802.1X: 50 bytes from 96:69:b4:1e:93:92 2025-06-06 07:33:27 IEEE 802.1X: version=1 type=0 length=46 2025-06-06 07:33:27 20407.031 96:69:b4:1e:93:92 <eh> recv IEEE 802.1X ver=1 type=0 (EAP_PACKET) data len=46 2025-06-06 07:33:27 EAP: code=2 (response) identifier=245 length=46 2025-06-06 07:33:27 06809.031 2025-06-06 07:33:27 HOSTAPD: <0>22.22.22.6:5246<0-0> STA 96:69:b4:1e:93:92 IEEE 802.1X: received EAP packet (code=2 id=245 len=46) from STA: EAP Response-unknown (25) 2025-06-06 07:33:27 IEEE 802.1X: <0>22.22.22.6:5246<0-0> 96:69:b4:1e:93:92 BE_AUTH entering state RESPONSE 2025-06-06 07:33:27 EAP: EAP entering state RECEIVED2 2025-06-06 07:33:27 EAP: parseEapResp: rxResp=1 rxInitiate=0 respId=245 respMethod=25 respVendor=0 respVendorMethod=0 2025-06-06 07:33:27 EAP: EAP entering state AAA_REQUEST 2025-06-06 07:33:27 EAP: EAP entering state AAA_IDLE 2025-06-06 07:33:27 Encapsulating EAP message into a RADIUS packet 2025-06-06 07:33:27 Copied RADIUS State Attribute 2025-06-06 07:33:27 06809.033 2025-06-06 07:33:27 HOSTAPD: <0>22.22.22.6:5246<0-0> Sending RADIUS message to authentication server 10.36.196.164 by sock 15 2025-06-06 07:33:27 RADIUS message: code=1 (Access-Request) identifier=240 length=354 2025-06-06 07:33:27 Attribute 1 (User-Name) length=9 2025-06-06 07:33:27 Value: 's@s.com' 2025-06-06 07:33:27 Attribute 4 (NAS-IP-Address) length=6 2025-06-06 07:33:27 Value: 0.0.0.0 2025-06-06 07:33:27 Attribute 32 (NAS-Identifier) length=26 2025-06-06 07:33:27 Value: '22.22.22.6/5246-TKM-WPA3' 2025-06-06 07:33:27 Attribute 30 (Called-Station-Id) length=28 2025-06-06 07:33:27 Value: '78-18-EC-99-1B-68:TKM-WPA3' 2025-06-06 07:33:27 Attribute 61 (NAS-Port-Type) length=6 2025-06-06 07:33:27 Value: 19 2025-06-06 07:33:27 Attribute 6 (Service-Type) length=6 2025-06-06 07:33:27 Value: 2 2025-06-06 07:33:27 Attribute 5 (NAS-Port) length=6 2025-06-06 07:33:27 Value: 1 2025-06-06 07:33:27 Attribute 26 (Vendor-Specific) length=16 2025-06-06 07:33:27 Value: 00003044070a544b4d2d57504133 2025-06-06 07:33:27 Attribute 26 (Vendor-Specific) length=24 2025-06-06 07:33:27 Value: 00003044081246503434314b54463234303030393636 2025-06-06 07:33:27 Attribute 31 (Calling-Station-Id) length=19 2025-06-06 07:33:27 Value: '96-69-B4-1E-93-92' 2025-06-06 07:33:27 Attribute 77 (Connect-Info) length=32 2025-06-06 07:33:27 Value: 'CONNECT 0/0Mbps(Tx/Rx) 11AX_2G' 2025-06-06 07:33:27 Attribute 44 (Acct-Session-Id) length=18 2025-06-06 07:33:27 Value: '68245D2800000468' 2025-06-06 07:33:27 Attribute 50 (Acct-Multi-Session-Id) length=18 2025-06-06 07:33:27 Value: '443479F1ED5421F2' 2025-06-06 07:33:27 Attribute 177 (Mobility-Domain-Id) length=6 2025-06-06 07:33:27 Value: 1000 2025-06-06 07:33:27 Attribute 186 (WLAN-Pairwise-Cipher) length=6 2025-06-06 07:33:27 Value: 000fac04 2025-06-06 07:33:27 Attribute 187 (WLAN-Group-Cipher) length=6 2025-06-06 07:33:27 Value: 000fac04 2025-06-06 07:33:27 Attribute 188 (WLAN-AKM-Suite) length=6 2025-06-06 07:33:27 Value: 000fac03 2025-06-06 07:33:27 Attribute 189 (WLAN-Group-Mgmt-Pairwise-Cipher) length=6 2025-06-06 07:33:27 Value: 000fac06 2025-06-06 07:33:27 Attribute 12 (Framed-MTU) length=6 2025-06-06 07:33:27 Value: 1400 2025-06-06 07:33:27 Attribute 79 (EAP-Message) length=48 2025-06-06 07:33:27 Value: 02f5002e1900170303002320249903bfec7d766ffc3b36aef49e1771ac4870401ca2b471320156b065a3c064bd8d 2025-06-06 07:33:27 Attribute 24 (State) length=18 2025-06-06 07:33:27 Value: b553f5a4b3a6ec0df038f77ef6fabab2 2025-06-06 07:33:27 Attribute 80 (Message-Authenticator) length=18 2025-06-06 07:33:27 Value: cb5c0575cf4426b09500a1fe4a954ef5 2025-06-06 07:33:27 20407.038 96:69:b4:1e:93:92 <eh> RADIUS message (type=0) ==> RADIUS Server code=1 (Access-Request) id=240 len=354 2025-06-06 07:33:27 06809.038 2025-06-06 07:33:27 Next RADIUS client retransmit in 3 seconds 2025-06-06 07:33:27 06809.039 2025-06-06 07:33:27 Reveived 181 bytes RADIUS message from authentication server 10.36.196.164 :1812 by sock 15 2025-06-06 07:33:27 RADIUS message: code=2 (Access-Accept) identifier=240 length=181 2025-06-06 07:33:27 Attribute 80 (Message-Authenticator) length=18 2025-06-06 07:33:27 Value: 7222b236809313010baa0dbfa90424d3 2025-06-06 07:33:27 Attribute 27 (Session-Timeout) length=6 2025-06-06 07:33:27 Value: 300 2025-06-06 07:33:27 Attribute 1 (User-Name) length=9 2025-06-06 07:33:27 Value: 's@s.com' 2025-06-06 07:33:27 Attribute 26 (Vendor-Specific) length=58 2025-06-06 07:33:27 Value: 000001371134d1837b23acdf02ec6583271527021c3f69aed390364a840889a83a4b80d50599ed4fd6ddf7a5fd771f59aa81c63830f5b0f6 2025-06-06 07:33:27 Attribute 26 (Vendor-Specific) length=58 2025-06-06 07:33:27 Value: 000001371034da9a4b69254f9a7303188d1419c63f9276c27615120944150a7c2d0c10dddc396989f672da148baa41ea19e3cffb9adbe5d2 2025-06-06 07:33:27 Attribute 79 (EAP-Message) length=6 2025-06-06 07:33:27 Value: 03f50004 2025-06-06 07:33:27 Attribute 12 (Framed-MTU) length=6 2025-06-06 07:33:27 Value: 1170 2025-06-06 07:33:27 06809.041 2025-06-06 07:33:27 STA 96:69:b4:1e:93:92 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec 2025-06-06 07:33:27 20407.041 96:69:b4:1e:93:92 <eh> RADIUS message (type=0) <== RADIUS Server code=2 (Access-Accept) id=240 len=181 2025-06-06 07:33:27 RADIUS packet matching with station 96:69:b4:1e:93:92 2025-06-06 07:33:27 06809.041 2025-06-06 07:33:27 HOSTAPD: <0>22.22.22.6:5246<0-0> STA 96:69:b4:1e:93:92 IEEE 802.1X: Acct-Interim-Interval, local configured 0, in Ac cess-Accept 0, pick up 0 2025-06-06 07:33:27 06809.042 2025-06-06 07:33:27 HOSTAPD: <0>22.22.22.6:5246<0-0> STA 96:69:b4:1e:93:92 IEEE 802.11: setting session timeout to 300 seconds 2025-06-06 07:33:27 06809.042 2025-06-06 07:33:27 HOSTAPD: WIDS_EAPOL_INFO (79B) ==>96:69:b4:1e:93:92 ws (0-22.22.22.6:5246) rId 0 wId 0 78:18:ec:99:1b:70 2025-06-06 07:33:27 06809.042 2025-06-06 07:33:27 HOSTAPD: <0>22.22.22.6:5246<0-0> sending E2C_WIDS_EAPOL_INFO (211 bytes) to_ipc 1 children 0 2025-06-06 07:33:27 Sending data - hexdump(len=211): 2025-06-06 07:33:27 0000: 09 03 00 00 00 00 00 00 00 00 00 00 06 16 16 16 ................ 2025-06-06 07:33:27 0010: 7E 14 00 00 78 18 EC 99 1B 68 00 00 00 00 00 00 ~...x....h...... 2025-06-06 07:33:27 0020: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 2025-06-06 07:33:27 0030: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 2025-06-06 07:33:27 0040: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 2025-06-06 07:33:27 0050: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 2025-06-06 07:33:27 0060: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 2025-06-06 07:33:27 0070: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 2025-06-06 07:33:27 0080: 4F 00 00 00 01 73 40 73 2E 63 6F 6D 00 D8 02 E5 O....s@s.com.... 2025-06-06 07:33:27 0090: 7F 00 00 00 00 C7 E9 15 A0 83 BE 17 00 00 00 00 ................ 2025-06-06 07:33:27 00a0: 00 00 00 00 00 00 00 00 00 00 00 00 49 47 49 4E ............IGIN 2025-06-06 07:33:27 00b0: 0D 0A 0D 0A 25 73 00 00 00 00 00 00 25 73 3A 25 ....%s......%s:% 2025-06-06 07:33:27 00c0: 64 20 70 69 64 3D 96 69 B4 1E 93 92 78 18 EC 99 d pid=.i....x... 2025-06-06 07:33:27 00d0: 1B 70 00 .p. 2025-06-06 07:33:27 06809.043 2025-06-06 07:33:27 HOSTAPD: <0>22.22.22.6:5246<0-0> sent E2C_WIDS_EAPOL_INFO (211 bytes) to /tmp/cwCwAcSocket 2025-06-06 07:33:27 IEEE 802.1X: Username in Accept-Accept - hexdump(len=7): 2025-06-06 07:33:27 0000: 73 40 73 2E 63 6F 6D s@s.com 2025-06-06 07:33:27 MS-MPPE-Send-Key - hexdump(len=32): [REMOVED] 2025-06-06 07:33:27 MS-MPPE-Recv-Key - hexdump(len=32): [REMOVED] 2025-06-06 07:33:27 06809.044 2025-06-06 07:33:27 HOSTAPD: <0>22.22.22.6:5246<0-0> STA 96:69:b4:1e:93:92 IEEE 802.1X: old identity 's@s.com' updated with User-Name fr om Access-Accept 's@s.com' 2025-06-06 07:33:27 06809.044 2025-06-06 07:33:27 HOSTAPD: <0>22.22.22.6:5246<0-0> STA 96:69:b4:1e:93:92 IEEE 802.1X: decapsulated EAP packet (code=3 id=245 len=4) fr om RADIUS server: EAP Success 2025-06-06 07:33:27 EAP: EAP entering state SUCCESS2 2025-06-06 07:33:27 : CTRL-EVENT-EAP-SUCCESS2 96:69:b4:1e:93:92 2025-06-06 07:33:27 IEEE 802.1X: <0>22.22.22.6:5246<0-0> 96:69:b4:1e:93:92 BE_AUTH entering state SUCCESS 2025-06-06 07:33:27 06809.045 2025-06-06 07:33:27 HOSTAPD: <0>22.22.22.6:5246<0-0> STA 96:69:b4:1e:93:92 IEEE 802.1X: Sending EAP Packet (identifier 245) 2025-06-06 07:33:27 20407.045 96:69:b4:1e:93:92 <eh> send IEEE 802.1X ver=2 type=0 (EAP_PACKET) data len=4 2025-06-06 07:33:27 20407.045 96:69:b4:1e:93:92 <eh> IEEE 802.1X (EAPOL 8B) ==> 96:69:b4:1e:93:92 ws (0-22.22.22.6:5246) rId 0 wId 0 78:18:ec:99:1b:70 2025-06-06 07:33:27 06809.045 2025-06-06 07:33:27 HOSTAPD: <0>22.22.22.6:5246<0-0> sending E2C_8021X (154 bytes) to_ipc 1 children 0 2025-06-06 07:33:27 Sending data - hexdump(len=154): 2025-06-06 07:33:27 0000: 00 03 00 00 00 00 00 00 00 00 00 00 06 16 16 16 ................ 2025-06-06 07:33:27 0010: 7E 14 00 00 78 18 EC 99 1B 68 00 00 00 00 00 00 ~...x....h...... 2025-06-06 07:33:27 0020: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 2025-06-06 07:33:27 0030: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 2025-06-06 07:33:27 0040: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 2025-06-06 07:33:27 0050: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 2025-06-06 07:33:27 0060: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 2025-06-06 07:33:27 0070: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 2025-06-06 07:33:27 0080: 16 00 00 00 96 69 B4 1E 93 92 78 18 EC 99 1B 70 .....i....x....p 2025-06-06 07:33:27 0090: 88 8E 02 00 00 04 03 F5 00 04 .......... 2025-06-06 07:33:27 06809.046 2025-06-06 07:33:27 HOSTAPD: <0>22.22.22.6:5246<0-0> sent E2C_8021X (154 bytes) to /tmp/cwCwAcSocket 2025-06-06 07:33:27 IEEE 802.1X: <0>22.22.22.6:5246<0-0> 96:69:b4:1e:93:92 BE_AUTH entering state IDLE 2025-06-06 07:33:27 WPA: <0>22.22.22.6:5246<0-0> 96:69:b4:1e:93:92 WPA_PTK entering state INITPMK 2025-06-06 07:33:27 WPA: 96:69:b4:1e:93:92PMK from EAPOL state machine (MSK len=64 PMK len=32) 2025-06-06 07:33:27 WPA: <0>22.22.22.6:5246<0-0> 96:69:b4:1e:93:92 WPA_PTK entering state PTKSTART 2025-06-06 07:33:27 06809.047 2025-06-06 07:33:27 HOSTAPD: <0>22.22.22.6:5246<0-0> STA 96:69:b4:1e:93:92 WPA: sending 1/4 msg of 4-Way Handshake 2025-06-06 07:33:27 20407.047 96:69:b4:1e:93:92 <eh> send 1/4 msg of 4-Way Handshake 2025-06-06 07:33:27 RSN: Derive PMKID using HMAC-SHA-1 2025-06-06 07:33:27 RSN: Derived PMKID - hexdump(len=16): 2025-06-06 07:33:27 0000: 71 A7 4B 54 84 60 4A AF AE C0 63 94 6D 4E 39 9E 2025-06-06 07:33:27 RSN: Message 1/4 PMKID derived from PMK - hexdump(len=16): 2025-06-06 07:33:27 0000: 71 A7 4B 54 84 60 4A AF AE C0 63 94 6D 4E 39 9E 2025-06-06 07:33:27 WPA: Send EAPOL(version=3 secure=0 mic=0 ack=1 install=0 pairwise=1 kde_len=22 keyidx=0 encr=0) 2025-06-06 07:33:27 WPA: Replay Counter - hexdump(len=8): 2025-06-06 07:33:27 0000: 00 00 00 00 00 00 00 01 2025-06-06 07:33:27 20407.048 96:69:b4:1e:93:92 <eh> send IEEE 802.1X ver=2 type=3 (EAPOL_KEY) data len=117 replay cnt 1 2025-06-06 07:33:27 20407.048 96:69:b4:1e:93:92 <eh> IEEE 802.1X (EAPOL 121B) ==> 96:69:b4:1e:93:92 ws (0-22.22.22.6:5246) rId 0 wId 0 78:18:ec:99:1b:70 2025-06-06 07:33:27 06809.048 2025-06-06 07:33:27 HOSTAPD: <0>22.22.22.6:5246<0-0> sending E2C_8021X (267 bytes) to_ipc 1 children 0 2025-06-06 07:33:27 Sending data - hexdump(len=267): 2025-06-06 07:33:27 0000: 00 03 00 00 00 00 00 00 00 00 00 00 06 16 16 16 ................ 2025-06-06 07:33:27 0010: 7E 14 00 00 78 18 EC 99 1B 68 00 00 00 00 00 00 ~...x....h...... 2025-06-06 07:33:27 0020: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 2025-06-06 07:33:27 0030: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 2025-06-06 07:33:27 0040: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 2025-06-06 07:33:27 0050: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 2025-06-06 07:33:27 0060: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 2025-06-06 07:33:27 0070: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 2025-06-06 07:33:27 0080: 87 00 00 00 96 69 B4 1E 93 92 78 18 EC 99 1B 70 .....i....x....p 2025-06-06 07:33:27 0090: 88 8E 02 03 00 75 02 00 8B 00 10 00 00 00 00 00 .....u.......... 2025-06-06 07:33:27 00a0: 00 00 01 E4 7F DB E5 1A 6F 24 E6 E9 1E 38 06 6C ........o$...8.l 2025-06-06 07:33:27 00b0: 8E 18 85 6C F0 6C 3A 30 84 DF 3E 4B F7 45 5E 05 ...l.l:0..>K.E^. 2025-06-06 07:33:27 00c0: F9 0B BD 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 2025-06-06 07:33:27 00d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 2025-06-06 07:33:27 00e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 2025-06-06 07:33:27 00f0: 00 00 00 00 16 DD 14 00 0F AC 04 71 A7 4B 54 84 ...........q.KT. 2025-06-06 07:33:27 ...... (11 bytes truncated) 2025-06-06 07:33:27 06809.050 2025-06-06 07:33:27 HOSTAPD: <0>22.22.22.6:5246<0-0> sent E2C_8021X (267 bytes) to /tmp/cwCwAcSocket 2025-06-06 07:33:27 WPA: Use EAPOL-Key timeout of 1000 ms (retry counter 1) 2025-06-06 07:33:27 06809.054 2025-06-06 07:33:27 HOSTAPD: <0>22.22.22.6:5246<0-0> Received C2E_8021X (405 bytes) from /tmp/cwCwAcSocket 2025-06-06 07:33:27 Received data - hexdump(len=405): 2025-06-06 07:33:27 0000: 00 02 00 00 22 20 73 65 00 00 00 00 06 16 16 16 ...." se........ 2025-06-06 07:33:27 0010: 7E 14 00 00 78 18 EC 99 1B 70 6E 61 6C 22 20 65 ~...x....pnal" e 2025-06-06 07:33:27 0020: 6E 63 72 79 70 74 69 6F 6E 3D 22 41 45 53 22 20 ncryption="AES" 2025-06-06 07:33:27 0030: 73 69 67 6E 61 6C 3D 2D 39 30 20 6E 6F 69 73 65 signal=-90 noise 2025-06-06 07:33:27 0040: 3D 2D 39 35 20 6C 69 76 65 3D 31 33 39 33 38 31 =-95 live=139381 2025-06-06 07:33:27 0050: 38 20 61 67 65 3D 36 31 20 6F 6E 77 69 72 65 3D 8 age=61 onwire= 2025-06-06 07:33:27 0060: 6E 6F 20 64 65 74 65 63 74 69 6F 6E 00 30 42 31 no detection.0B1 2025-06-06 07:33:27 0070: 00 00 00 00 06 78 18 EC 99 1B 70 00 04 D3 32 01 .....x....p...2. 2025-06-06 07:33:27 0080: 11 01 00 00 78 18 EC 99 1B 70 96 69 B4 1E 93 92 ....x....p.i.... 2025-06-06 07:33:27 0090: 88 8E 02 03 00 FF 02 01 0B 00 10 00 00 00 00 00 ................ 2025-06-06 07:33:27 00a0: 00 00 01 BD A4 F3 CA A5 30 47 49 F9 3C 02 4A A4 ........0GI.<.J. 2025-06-06 07:33:27 00b0: AE FE F0 9A C0 5B DD 24 93 9D 97 73 86 A0 2B CE .....[.$...s..+. 2025-06-06 07:33:27 00c0: 32 A1 8D 00 00 00 00 00 00 00 00 00 00 00 00 00 2............... 2025-06-06 07:33:27 00d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 2025-06-06 07:33:27 00e0: 00 00 00 FB 62 C3 D9 BB 9D 69 EC 8C AC 92 38 AC ....b....i....8. 2025-06-06 07:33:27 00f0: 2B 57 B8 00 A0 30 26 01 00 00 0F AC 04 01 00 00 +W...0&......... 2025-06-06 07:33:27 ...... (149 bytes truncated) 2025-06-06 07:33:27 20407.056 96:69:b4:1e:93:92 <eh> IEEE 802.1X (EAPOL 259B) <== 96:69:b4:1e:93:92 ws (0-22.22.22.6:5246) rId 0 wId 0 78:18:ec:99:1b:70 2025-06-06 07:33:27 IEEE 802.1X: 259 bytes from 96:69:b4:1e:93:92 2025-06-06 07:33:27 IEEE 802.1X: version=2 type=3 length=255 2025-06-06 07:33:27 20407.056 96:69:b4:1e:93:92 <eh> recv IEEE 802.1X ver=2 type=3 (EAPOL_KEY) data len=255 2025-06-06 07:33:27 WPA: RX EAPOL data - hexdump(len=259): 2025-06-06 07:33:27 0000: 02 03 00 FF 02 01 0B 00 10 00 00 00 00 00 00 00 2025-06-06 07:33:27 0010: 01 BD A4 F3 CA A5 30 47 49 F9 3C 02 4A A4 AE FE 2025-06-06 07:33:27 0020: F0 9A C0 5B DD 24 93 9D 97 73 86 A0 2B CE 32 A1 2025-06-06 07:33:27 0030: 8D 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2025-06-06 07:33:27 0040: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2025-06-06 07:33:27 0050: 00 FB 62 C3 D9 BB 9D 69 EC 8C AC 92 38 AC 2B 57 2025-06-06 07:33:27 0060: B8 00 A0 30 26 01 00 00 0F AC 04 01 00 00 0F AC 2025-06-06 07:33:27 0070: 04 01 00 00 0F AC 03 CC 00 01 00 5A AB 07 58 71 2025-06-06 07:33:27 0080: 5D 4D 01 77 FA CA C6 34 A7 8E B0 36 03 03 E8 00 2025-06-06 07:33:27 0090: 37 71 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2025-06-06 07:33:27 00a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2025-06-06 07:33:27 00b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2025-06-06 07:33:27 00c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2025-06-06 07:33:27 00d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2025-06-06 07:33:27 00e0: 00 00 00 00 01 06 78 18 EC 99 1B 70 03 15 30 2D 2025-06-06 07:33:27 00f0: 32 32 2E 32 32 2E 32 32 2E 36 3A 35 32 34 36 2D 2025-06-06 07:33:27 ...... (3 bytes truncated) 2025-06-06 07:33:27 WPA: Received EAPOL-Key from 96:69:b4:1e:93:92 key_info=0x10b type=2 mic_len=16 key_data_length=160 2025-06-06 07:33:27 WPA: EAPOL-Key header (ending before Key MIC) - hexdump(len=77): 2025-06-06 07:33:27 0000: 02 01 0B 00 10 00 00 00 00 00 00 00 01 BD A4 F3 2025-06-06 07:33:27 0010: CA A5 30 47 49 F9 3C 02 4A A4 AE FE F0 9A C0 5B 2025-06-06 07:33:27 0020: DD 24 93 9D 97 73 86 A0 2B CE 32 A1 8D 00 00 00 2025-06-06 07:33:27 0030: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2025-06-06 07:33:27 0040: 00 00 00 00 00 00 00 00 00 00 00 00 00 2025-06-06 07:33:27 WPA: EAPOL-Key Key MIC - hexdump(len=16): 2025-06-06 07:33:27 0000: FB 62 C3 D9 BB 9D 69 EC 8C AC 92 38 AC 2B 57 B8 2025-06-06 07:33:27 WPA: Received Key Nonce - hexdump(len=32): 2025-06-06 07:33:27 0000: BD A4 F3 CA A5 30 47 49 F9 3C 02 4A A4 AE FE F0 2025-06-06 07:33:27 0010: 9A C0 5B DD 24 93 9D 97 73 86 A0 2B CE 32 A1 8D 2025-06-06 07:33:27 WPA: Received Replay Counter - hexdump(len=8): 2025-06-06 07:33:27 0000: 00 00 00 00 00 00 00 01 2025-06-06 07:33:27 20407.058 96:69:b4:1e:93:92 <eh> recv EAPOL-Key 2/4 Pairwise replay cnt 1 2025-06-06 07:33:27 06809.059 2025-06-06 07:33:27 HOSTAPD: <0>22.22.22.6:5246<0-0> STA 96:69:b4:1e:93:92 WPA: received EAPOL-Key frame (2/4 Pairwise) 2025-06-06 07:33:27 WPA: <0>22.22.22.6:5246<0-0> 96:69:b4:1e:93:92 WPA_PTK entering state PTKCALCNEGOTIATING 2025-06-06 07:33:27 FT: Derive PMK-R0 using KDF-SHA256 2025-06-06 07:33:27 FT: XXKey - hexdump(len=32): [REMOVED] 2025-06-06 07:33:27 FT: SSID - hexdump_ascii(len=8): 2025-06-06 07:33:27 0000: 54 4B 4D 2D 57 50 41 33 TKM-WPA3 2025-06-06 07:33:27 FT: MDID - hexdump(len=2): 2025-06-06 07:33:27 0000: 03 E8 2025-06-06 07:33:27 FT: R0KH-ID - hexdump_ascii(len=21): 2025-06-06 07:33:27 0000: 30 2D 32 32 2E 32 32 2E 32 32 2E 36 3A 35 32 34 0-22.22.22.6:524 2025-06-06 07:33:27 0010: 36 2D 30 2D 30 6-0-0 2025-06-06 07:33:27 FT: S0KH-ID: 96:69:b4:1e:93:92 2025-06-06 07:33:27 FT: PMK-R0 - hexdump(len=32): [REMOVED] 2025-06-06 07:33:27 FT: PMK-R0Name-Salt - hexdump(len=16): [REMOVED] 2025-06-06 07:33:27 FT: PMKR0Name - hexdump(len=16): 2025-06-06 07:33:27 0000: A6 45 B2 D3 39 DB 1A AD 27 9E 67 77 15 86 EA AA 2025-06-06 07:33:27 FT: Derive PMK-R1 using KDF-SHA256 2025-06-06 07:33:27 FT: PMK-R0 - hexdump(len=32): [REMOVED] 2025-06-06 07:33:27 FT: R1KH-ID - hexdump(len=6): 2025-06-06 07:33:27 0000: 78 18 EC 99 1B 70 2025-06-06 07:33:27 FT: S1KH-ID: 96:69:b4:1e:93:92 2025-06-06 07:33:27 FT: PMK-R1 - hexdump(len=32): [REMOVED] 2025-06-06 07:33:27 FT: PMKR1Name (using SHA256) - hexdump(len=16): 2025-06-06 07:33:27 0000: 5A AB 07 58 71 5D 4D 01 77 FA CA C6 34 A7 8E B0 2025-06-06 07:33:27 FT: Derive PTK using KDF-SHA256 2025-06-06 07:33:27 FT: PMK-R1 - hexdump(len=32): [REMOVED] 2025-06-06 07:33:27 FT: SNonce - hexdump(len=32): 2025-06-06 07:33:27 0000: BD A4 F3 CA A5 30 47 49 F9 3C 02 4A A4 AE FE F0 2025-06-06 07:33:27 0010: 9A C0 5B DD 24 93 9D 97 73 86 A0 2B CE 32 A1 8D 2025-06-06 07:33:27 FT: ANonce - hexdump(len=32): 2025-06-06 07:33:27 0000: E4 7F DB E5 1A 6F 24 E6 E9 1E 38 06 6C 8E 18 85 2025-06-06 07:33:27 0010: 6C F0 6C 3A 30 84 DF 3E 4B F7 45 5E 05 F9 0B BD 2025-06-06 07:33:27 FT: BSSID=78:18:ec:99:1b:70 STA-ADDR=96:69:b4:1e:93:92 2025-06-06 07:33:27 FT: PTK - hexdump(len=48): [REMOVED] 2025-06-06 07:33:27 FT: PMKR1Name - hexdump(len=16): 2025-06-06 07:33:27 0000: 5A AB 07 58 71 5D 4D 01 77 FA CA C6 34 A7 8E B0 2025-06-06 07:33:27 FT: KCK - hexdump(len=16): [REMOVED] 2025-06-06 07:33:27 FT: KEK - hexdump(len=16): [REMOVED] 2025-06-06 07:33:27 FT: TK - hexdump(len=16): [REMOVED] 2025-06-06 07:33:27 FT: PTKName - hexdump(len=16): 2025-06-06 07:33:27 0000: 80 CC 86 34 81 5F 79 44 8C 5C 18 04 75 08 23 C1 2025-06-06 07:33:27 WPA: EAPOL-Key MIC using AES-CMAC 2025-06-06 07:33:27 WPA: RSN IE in EAPOL-Key - hexdump(len=40): 2025-06-06 07:33:27 0000: 30 26 01 00 00 0F AC 04 01 00 00 0F AC 04 01 00 2025-06-06 07:33:27 0010: 00 0F AC 03 CC 00 01 00 5A AB 07 58 71 5D 4D 01 2025-06-06 07:33:27 0020: 77 FA CA C6 34 A7 8E B0 2025-06-06 07:33:27 WPA: MDIE in EAPOL-Key - hexdump(len=5): 2025-06-06 07:33:27 0000: 36 03 03 E8 00 2025-06-06 07:33:27 WPA: FTIE in EAPOL-Key - hexdump(len=115): 2025-06-06 07:33:27 0000: 37 71 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2025-06-06 07:33:27 0010: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2025-06-06 07:33:27 0020: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2025-06-06 07:33:27 0030: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2025-06-06 07:33:27 0040: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2025-06-06 07:33:27 0050: 00 00 00 00 01 06 78 18 EC 99 1B 70 03 15 30 2D 2025-06-06 07:33:27 0060: 32 32 2E 32 32 2E 32 32 2E 36 3A 35 32 34 36 2D 2025-06-06 07:33:27 0070: 30 2D 30 2025-06-06 07:33:27 FT: PMKR1Name from Supplicant - hexdump(len=16): 2025-06-06 07:33:27 0000: 5A AB 07 58 71 5D 4D 01 77 FA CA C6 34 A7 8E B0 2025-06-06 07:33:27 WPA: <0>22.22.22.6:5246<0-0> 96:69:b4:1e:93:92 WPA_PTK entering state PTKCALCNEGOTIATING2 2025-06-06 07:33:27 WPA: <0>22.22.22.6:5246<0-0> 96:69:b4:1e:93:92 WPA_PTK entering state PTKGETRSC 2025-06-06 07:33:27 WPA: <0>22.22.22.6:5246<0-0> 96:69:b4:1e:93:92 WPA_PTK entering state PTKINITNEGOTIATING 2025-06-06 07:33:27 06809.065 2025-06-06 07:33:27 HOSTAPD: <0>22.22.22.6:5246<0-0> STA 96:69:b4:1e:93:92 WPA: sending 3/4 msg of 4-Way Handshake 2025-06-06 07:33:27 20407.065 96:69:b4:1e:93:92 <eh> send 3/4 msg of 4-Way Handshake 2025-06-06 07:33:27 RSN: RSNE before modification - hexdump(len=32): 2025-06-06 07:33:27 0000: 30 1E 01 00 00 0F AC 04 01 00 00 0F AC 04 02 00 2025-06-06 07:33:27 0010: 00 0F AC 03 00 0F AC 05 C1 00 00 00 00 0F AC 06 2025-06-06 07:33:27 RSN: RSNE after modification (PMKID inserted) - hexdump(len=48): 2025-06-06 07:33:27 0000: 30 2E 01 00 00 0F AC 04 01 00 00 0F AC 04 02 00 2025-06-06 07:33:27 0010: 00 0F AC 03 00 0F AC 05 C1 00 01 00 5A AB 07 58 2025-06-06 07:33:27 0020: 71 5D 4D 01 77 FA CA C6 34 A7 8E B0 00 0F AC 06 2025-06-06 07:33:27 WPA: Send EAPOL(version=3 secure=1 mic=1 ack=1 install=1 pairwise=1 kde_len=236 keyidx=0 encr=1) 2025-06-06 07:33:27 WPA: Replay Counter - hexdump(len=8): 2025-06-06 07:33:27 0000: 00 00 00 00 00 00 00 02 2025-06-06 07:33:27 Plaintext EAPOL-Key Key Data - hexdump(len=248): [REMOVED] 2025-06-06 07:33:27 WPA: Encrypt Key Data using AES-WRAP (KEK length 16) 2025-06-06 07:33:27 WPA: EAPOL-Key MIC using AES-CMAC 2025-06-06 07:33:27 20407.066 96:69:b4:1e:93:92 <eh> send IEEE 802.1X ver=2 type=3 (EAPOL_KEY) data len=343 replay cnt 2 2025-06-06 07:33:27 20407.066 96:69:b4:1e:93:92 <eh> IEEE 802.1X (EAPOL 347B) ==> 96:69:b4:1e:93:92 ws (0-22.22.22.6:5246) rId 0 wId 0 78:18:ec:99:1b:70 2025-06-06 07:33:27 06809.066 2025-06-06 07:33:27 HOSTAPD: <0>22.22.22.6:5246<0-0> sending E2C_8021X (493 bytes) to_ipc 1 children 0 2025-06-06 07:33:27 Sending data - hexdump(len=493): 2025-06-06 07:33:27 0000: 00 03 00 00 00 00 00 00 00 00 00 00 06 16 16 16 ................ 2025-06-06 07:33:27 0010: 7E 14 00 00 78 18 EC 99 1B 68 00 00 00 00 00 00 ~...x....h...... 2025-06-06 07:33:27 0020: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 2025-06-06 07:33:27 0030: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 2025-06-06 07:33:27 0040: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 2025-06-06 07:33:27 0050: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 2025-06-06 07:33:27 0060: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 2025-06-06 07:33:27 0070: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 2025-06-06 07:33:27 0080: 69 01 00 00 96 69 B4 1E 93 92 78 18 EC 99 1B 70 i....i....x....p 2025-06-06 07:33:27 0090: 88 8E 02 03 01 57 02 13 CB 00 10 00 00 00 00 00 .....W.......... 2025-06-06 07:33:27 00a0: 00 00 02 E4 7F DB E5 1A 6F 24 E6 E9 1E 38 06 6C ........o$...8.l 2025-06-06 07:33:27 00b0: 8E 18 85 6C F0 6C 3A 30 84 DF 3E 4B F7 45 5E 05 ...l.l:0..>K.E^. 2025-06-06 07:33:27 00c0: F9 0B BD 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 2025-06-06 07:33:27 00d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 2025-06-06 07:33:27 00e0: 00 00 00 B6 DC B9 B7 1E 77 29 5C 26 9C B2 FD 12 ........w)\&.... 2025-06-06 07:33:27 00f0: 2C 72 68 00 F8 4D 48 6C 26 12 49 79 BC D3 F9 6B ,rh..MHl&.Iy...k 2025-06-06 07:33:27 ...... (237 bytes truncated) 2025-06-06 07:33:27 06809.069 2025-06-06 07:33:27 HOSTAPD: <0>22.22.22.6:5246<0-0> sent E2C_8021X (493 bytes) to /tmp/cwCwAcSocket 2025-06-06 07:33:27 WPA: Use EAPOL-Key timeout of 1000 ms (retry counter 1) 2025-06-06 07:33:27 06809.074 2025-06-06 07:33:27 HOSTAPD: <0>22.22.22.6:5246<0-0> Received C2E_8021X (245 bytes) from /tmp/cwCwAcSocket 2025-06-06 07:33:27 Received data - hexdump(len=245): 2025-06-06 07:33:27 0000: 00 02 00 00 22 20 73 65 00 00 00 00 06 16 16 16 ...." se........ 2025-06-06 07:33:27 0010: 7E 14 00 00 78 18 EC 99 1B 70 6E 61 6C 22 20 65 ~...x....pnal" e 2025-06-06 07:33:27 0020: 6E 63 72 79 70 74 69 6F 6E 3D 22 41 45 53 22 20 ncryption="AES" 2025-06-06 07:33:27 0030: 73 69 67 6E 61 6C 3D 2D 39 30 20 6E 6F 69 73 65 signal=-90 noise 2025-06-06 07:33:27 0040: 3D 2D 39 35 20 6C 69 76 65 3D 31 33 39 33 37 39 =-95 live=139379 2025-06-06 07:33:27 0050: 36 20 61 67 65 3D 37 33 20 6F 6E 77 69 72 65 3D 6 age=73 onwire= 2025-06-06 07:33:27 0060: 6E 6F 20 64 65 74 65 63 74 69 6F 6E 00 30 42 31 no detection.0B1 2025-06-06 07:33:27 0070: 00 00 00 00 06 78 18 EC 99 1B 70 00 04 D3 32 01 .....x....p...2. 2025-06-06 07:33:27 0080: 71 00 00 00 78 18 EC 99 1B 70 96 69 B4 1E 93 92 q...x....p.i.... 2025-06-06 07:33:27 0090: 88 8E 02 03 00 5F 02 03 0B 00 10 00 00 00 00 00 ....._.......... 2025-06-06 07:33:27 00a0: 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 2025-06-06 07:33:27 00b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 2025-06-06 07:33:27 00c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 2025-06-06 07:33:27 00d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 2025-06-06 07:33:27 00e0: 00 00 00 BE CD DB 23 80 3C 35 19 6D E7 48 DF 35 ......#.<5.m.H.5 2025-06-06 07:33:27 00f0: BE EA C9 00 00 ..... 2025-06-06 07:33:27 20407.076 96:69:b4:1e:93:92 <eh> IEEE 802.1X (EAPOL 99B) <== 96:69:b4:1e:93:92 ws (0-22.22.22.6:5246) rId 0 wId 0 78:18:ec:99:1b:70 2025-06-06 07:33:27 IEEE 802.1X: 99 bytes from 96:69:b4:1e:93:92 2025-06-06 07:33:27 IEEE 802.1X: version=2 type=3 length=95 2025-06-06 07:33:27 20407.077 96:69:b4:1e:93:92 <eh> recv IEEE 802.1X ver=2 type=3 (EAPOL_KEY) data len=95 2025-06-06 07:33:27 WPA: RX EAPOL data - hexdump(len=99): 2025-06-06 07:33:27 0000: 02 03 00 5F 02 03 0B 00 10 00 00 00 00 00 00 00 2025-06-06 07:33:27 0010: 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2025-06-06 07:33:27 0020: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2025-06-06 07:33:27 0030: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2025-06-06 07:33:27 0040: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2025-06-06 07:33:27 0050: 00 BE CD DB 23 80 3C 35 19 6D E7 48 DF 35 BE EA 2025-06-06 07:33:27 0060: C9 00 00 2025-06-06 07:33:27 WPA: Received EAPOL-Key from 96:69:b4:1e:93:92 key_info=0x30b type=2 mic_len=16 key_data_length=0 2025-06-06 07:33:27 WPA: EAPOL-Key header (ending before Key MIC) - hexdump(len=77): 2025-06-06 07:33:27 0000: 02 03 0B 00 10 00 00 00 00 00 00 00 02 00 00 00 2025-06-06 07:33:27 0010: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2025-06-06 07:33:27 0020: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2025-06-06 07:33:27 0030: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2025-06-06 07:33:27 0040: 00 00 00 00 00 00 00 00 00 00 00 00 00 2025-06-06 07:33:27 WPA: EAPOL-Key Key MIC - hexdump(len=16): 2025-06-06 07:33:27 0000: BE CD DB 23 80 3C 35 19 6D E7 48 DF 35 BE EA C9 2025-06-06 07:33:27 WPA: Received Key Nonce - hexdump(len=32): 2025-06-06 07:33:27 0000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2025-06-06 07:33:27 0010: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2025-06-06 07:33:27 WPA: Received Replay Counter - hexdump(len=8): 2025-06-06 07:33:27 0000: 00 00 00 00 00 00 00 02 2025-06-06 07:33:27 20407.079 96:69:b4:1e:93:92 <eh> recv EAPOL-Key 4/4 Pairwise replay cnt 2 2025-06-06 07:33:27 06809.080 2025-06-06 07:33:27 HOSTAPD: <0>22.22.22.6:5246<0-0> STA 96:69:b4:1e:93:92 WPA: received EAPOL-Key frame (4/4 Pairwise) 2025-06-06 07:33:27 WPA: EAPOL-Key MIC using AES-CMAC 2025-06-06 07:33:27 WPA: <0>22.22.22.6:5246<0-0> 96:69:b4:1e:93:92 WPA_PTK entering state SETKEY 2025-06-06 07:33:27 RSN: Cache PMK - hexdump(len=32): [REMOVED] 2025-06-06 07:33:27 RSN: Derive PMKID using HMAC-SHA-1 2025-06-06 07:33:27 RSN: Derived PMKID - hexdump(len=16): 2025-06-06 07:33:27 0000: 1B D8 0F B8 FF 3F BD B7 01 A7 8E 00 85 E9 E5 E6 2025-06-06 07:33:27 RSN: added PMKSA cache entry for 96:69:b4:1e:93:92 2025-06-06 07:33:27 RSN: added PMKID - hexdump(len=16): 2025-06-06 07:33:27 0000: 1B D8 0F B8 FF 3F BD B7 01 A7 8E 00 85 E9 E5 E6 2025-06-06 07:33:27 06809.081 2025-06-06 07:33:27 HOSTAPD: <0>22.22.22.6:5246<0-0> sending E2C_PMKSA_CACHE (422 bytes) to_ipc 1 children 0 2025-06-06 07:33:27 Sending data - hexdump(len=422): 2025-06-06 07:33:27 0000: 10 03 00 00 00 00 00 00 00 00 00 00 06 16 16 16 ................ 2025-06-06 07:33:27 0010: 7E 14 00 00 78 18 EC 99 1B 68 00 00 00 00 00 00 ~...x....h...... 2025-06-06 07:33:27 0020: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 2025-06-06 07:33:27 0030: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 2025-06-06 07:33:27 0040: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 2025-06-06 07:33:27 0050: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 2025-06-06 07:33:27 0060: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 2025-06-06 07:33:27 0070: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 2025-06-06 07:33:27 0080: 22 01 00 00 01 00 00 06 96 69 B4 1E 93 92 01 06 "........i...... 2025-06-06 07:33:27 0090: 78 18 EC 99 1B 70 02 10 1B D8 0F B8 FF 3F BD B7 x....p.......?.. 2025-06-06 07:33:27 00a0: 01 A7 8E 00 85 E9 E5 E6 03 20 CA 60 90 01 E1 2C ......... .`..., 2025-06-06 07:33:27 00b0: C8 28 A7 F4 C0 AB 19 FC 34 7F 4A 97 60 1A DA C9 .(......4.J.`... 2025-06-06 07:33:27 00c0: 87 8A D4 C1 54 28 3F 2E 13 48 04 04 00 00 00 20 ....T(?..H..... 2025-06-06 07:33:27 00d0: 05 04 00 00 00 20 06 01 19 07 04 FF FF FF FF 0E ..... .......... 2025-06-06 07:33:27 00e0: 24 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 $............... 2025-06-06 07:33:27 00f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 2025-06-06 07:33:27 ...... (166 bytes truncated) 2025-06-06 07:33:27 06809.083 2025-06-06 07:33:27 HOSTAPD: <0>22.22.22.6:5246<0-0> sent E2C_PMKSA_CACHE (422 bytes) to /tmp/cwCwAcSocket 2025-06-06 07:33:27 06809.084 2025-06-06 07:33:27 HOSTAPD: <0>22.22.22.6:5246<0-0> STA 96:69:b4:1e:93:92 WPA: Added PMKSA cache entry (IEEE 802.1X) 2025-06-06 07:33:27 06809.084 2025-06-06 07:33:27 HOSTAPD: <0>22.22.22.6:5246<0-0> sending E2C_WLAN_KEY (838 bytes) to_ipc 1 children 0 2025-06-06 07:33:27 Sending data - hexdump(len=838): 2025-06-06 07:33:27 0000: 03 03 00 00 00 00 00 00 00 00 00 00 06 16 16 16 ................ 2025-06-06 07:33:27 0010: 7E 14 00 00 78 18 EC 99 1B 68 00 00 00 00 00 00 ~...x....h...... 2025-06-06 07:33:27 0020: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 2025-06-06 07:33:27 0030: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 2025-06-06 07:33:27 0040: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 2025-06-06 07:33:27 0050: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 2025-06-06 07:33:27 0060: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 2025-06-06 07:33:27 0070: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 2025-06-06 07:33:27 0080: C2 02 00 00 00 01 96 69 B4 1E 93 92 00 00 11 00 .......i........ 2025-06-06 07:33:27 0090: 01 73 40 73 2E 63 6F 6D 00 00 00 00 00 00 00 00 .s@s.com........ 2025-06-06 07:33:27 00a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 2025-06-06 07:33:27 00b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 2025-06-06 07:33:27 00c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 2025-06-06 07:33:27 00d0: 00 00 46 6F 72 74 69 47 75 65 73 74 00 00 00 00 ..FortiGuest.... 2025-06-06 07:33:27 00e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 2025-06-06 07:33:27 00f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 2025-06-06 07:33:27 ...... (582 bytes truncated) 2025-06-06 07:33:27 06809.086 2025-06-06 07:33:27 HOSTAPD: <0>22.22.22.6:5246<0-0> sent E2C_WLAN_KEY (838 bytes) to /tmp/cwCwAcSocket 2025-06-06 07:33:27 06809.087 2025-06-06 07:33:27 HOSTAPD: <0>22.22.22.6:5246<0-0> Received C2E_STA_IPADDR (150 bytes) from /tmp/cwCwAcSocket 2025-06-06 07:33:27 Received data - hexdump(len=150): 2025-06-06 07:33:27 0000: 0E 02 00 00 00 00 00 00 00 00 00 00 06 16 16 16 ................ 2025-06-06 07:33:27 0010: 7E 14 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ~............... 2025-06-06 07:33:27 0020: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 2025-06-06 07:33:27 0030: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 2025-06-06 07:33:27 0040: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 2025-06-06 07:33:27 0050: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 2025-06-06 07:33:27 0060: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 2025-06-06 07:33:27 0070: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 2025-06-06 07:33:27 0080: 12 00 00 00 96 69 B4 1E 93 92 02 C8 A8 C0 00 10 .....i.......... 2025-06-06 07:33:27 0090: 00 00 24 01 00 00 ..$... 2025-06-06 07:33:27 06809.088 2025-06-06 07:33:27 HOSTAPD: <0>22.22.22.6:5246<0-0> STA 96:69:b4:1e:93:92 IEEE 802.1X: unauthorized, ignore sta framed ip! 2025-06-06 07:33:27 06809.088 2025-06-06 07:33:27 HOSTAPD: <0>22.22.22.6:5246<0-0> Received C2E_WLAN_KEY (305 bytes) from /tmp/cwCwAcSocket 2025-06-06 07:33:27 Received data - hexdump(len=305): 2025-06-06 07:33:27 0000: 16 02 00 00 00 00 00 00 00 00 00 00 06 16 16 16 ................ 2025-06-06 07:33:27 0010: 7E 14 00 00 78 18 EC 99 1B 70 00 00 00 00 00 00 ~...x....p...... 2025-06-06 07:33:27 0020: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 2025-06-06 07:33:27 0030: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 2025-06-06 07:33:27 0040: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 2025-06-06 07:33:27 0050: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 2025-06-06 07:33:27 0060: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 2025-06-06 07:33:27 0070: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 2025-06-06 07:33:27 0080: AD 00 00 00 00 31 96 69 B4 1E 93 92 32 20 73 65 .....1.i....2 se 2025-06-06 07:33:27 0090: 72 76 65 72 3D 31 39 32 2E 31 36 38 2E 32 30 30 rver=192.168.200 2025-06-06 07:33:27 00a0: 2E 31 20 73 65 63 75 72 69 74 79 3D 22 57 50 41 .1 security="WPA 2025-06-06 07:33:27 00b0: 33 20 45 6E 74 65 72 70 72 69 73 65 20 4F 6E 6C 3 Enterprise Onl 2025-06-06 07:33:27 00c0: 79 22 20 65 6E 63 72 79 70 74 69 6F 6E 3D 22 41 y" encryption="A 2025-06-06 07:33:27 00d0: 45 53 22 20 61 63 74 69 6F 6E 3D 22 44 48 43 50 ES" action="DHCP 2025-06-06 07:33:27 00e0: 2D 41 43 4B 22 20 72 65 61 73 6F 6E 3D 22 4E 2F -ACK" reason="N/ 2025-06-06 07:33:27 00f0: 41 22 20 6D 73 67 3D 22 44 48 43 50 20 41 43 4B A" msg="DHCP ACK 2025-06-06 07:33:27 ...... (49 bytes truncated) 2025-06-06 07:33:27 06809.091 2025-06-06 07:33:27 hostapd_capwap_config_result: set ptk replied for addr 96:69:b4:1e:93:92 2025-06-06 07:33:27 WPA: <0>22.22.22.6:5246<0-0> 96:69:b4:1e:93:92 WPA_PTK entering state PTKINITDONE 2025-06-06 07:33:27 06809.091 2025-06-06 07:33:27 HOSTAPD: <0>22.22.22.6:5246<0-0> STA 96:69:b4:1e:93:92 WPA: pairwise key handshake completed (RSN) 2025-06-06 07:33:27 : EAPOL-4WAY-HS-COMPLETED 96:69:b4:1e:93:92 2025-06-06 07:33:27 20407.092 96:69:b4:1e:93:92 <eh> ***pairwise key handshake completed*** (RSN) 2025-06-06 07:33:27 IEEE 802.1X: <0>22.22.22.6:5246<0-0> 96:69:b4:1e:93:92 AUTH_PAE entering state AUTHENTICATED 2025-06-06 07:33:27 : AP-STA-CONNECTED 96:69:b4:1e:93:92 2025-06-06 07:33:27 06809.092 2025-06-06 07:33:27 HOSTAPD: <0>22.22.22.6:5246<0-0> STA 96:69:b4:1e:93:92 IEEE 802.1X: authorizing port 2025-06-06 07:33:27 06809.092 2025-06-06 07:33:27 HOSTAPD: <0>22.22.22.6:5246<0-0> STA 96:69:b4:1e:93:92 IEEE 802.1X: authenticated - EAP type: 25 (unknown) 2025-06-06 07:33:27 RSN: Cache PMK - hexdump(len=32): [REMOVED] 2025-06-06 07:33:27 RSN: Derive PMKID using HMAC-SHA-1 2025-06-06 07:33:27 RSN: Derived PMKID - hexdump(len=16): 2025-06-06 07:33:27 0000: 1B D8 0F B8 FF 3F BD B7 01 A7 8E 00 85 E9 E5 E6 2025-06-06 07:33:27 RSN: added PMKSA cache entry for 96:69:b4:1e:93:92 2025-06-06 07:33:27 RSN: added PMKID - hexdump(len=16): 2025-06-06 07:33:27 0000: 1B D8 0F B8 FF 3F BD B7 01 A7 8E 00 85 E9 E5 E6 2025-06-06 07:33:27 06809.094 2025-06-06 07:33:27 HOSTAPD: <0>22.22.22.6:5246<0-0> sending E2C_PMKSA_CACHE (422 bytes) to_ipc 1 children 0 2025-06-06 07:33:27 Sending data - hexdump(len=422): 2025-06-06 07:33:27 0000: 10 03 00 00 00 00 00 00 00 00 00 00 06 16 16 16 ................ 2025-06-06 07:33:27 0010: 7E 14 00 00 78 18 EC 99 1B 68 00 00 00 00 00 00 ~...x....h...... 2025-06-06 07:33:27 0020: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 2025-06-06 07:33:27 0030: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 2025-06-06 07:33:27 0040: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 2025-06-06 07:33:27 0050: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 2025-06-06 07:33:27 0060: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 2025-06-06 07:33:27 0070: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 2025-06-06 07:33:27 0080: 22 01 00 00 01 00 00 06 96 69 B4 1E 93 92 01 06 "........i...... 2025-06-06 07:33:27 0090: 78 18 EC 99 1B 70 02 10 1B D8 0F B8 FF 3F BD B7 x....p.......?.. 2025-06-06 07:33:27 00a0: 01 A7 8E 00 85 E9 E5 E6 03 20 CA 60 90 01 E1 2C ......... .`..., 2025-06-06 07:33:27 00b0: C8 28 A7 F4 C0 AB 19 FC 34 7F 4A 97 60 1A DA C9 .(......4.J.`... 2025-06-06 07:33:27 00c0: 87 8A D4 C1 54 28 3F 2E 13 48 04 04 00 00 00 20 ....T(?..H..... 2025-06-06 07:33:27 00d0: 05 04 00 00 00 20 06 01 19 07 04 FF FF FF FF 0E ..... .......... 2025-06-06 07:33:27 00e0: 24 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 $............... 2025-06-06 07:33:27 00f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 2025-06-06 07:33:27 ...... (166 bytes truncated) 2025-06-06 07:33:27 06809.096 2025-06-06 07:33:27 HOSTAPD: <0>22.22.22.6:5246<0-0> sent E2C_PMKSA_CACHE (422 bytes) to /tmp/cwCwAcSocket 2025-06-06 07:33:27 06809.096 2025-06-06 07:33:27 HOSTAPD: <0>22.22.22.6:5246<0-0> STA 96:69:b4:1e:93:92 WPA: Added PMKSA cache entry (IEEE 802.1X) 2025-06-06 07:33:27 06809.133 2025-06-06 07:33:27 HOSTAPD: <0>22.22.22.6:5246<0-0> Received C2E_STA_IPADDR (150 bytes) from /tmp/cwCwAcSocket 2025-06-06 07:33:27 Received data - hexdump(len=150): 2025-06-06 07:33:27 0000: 0E 02 00 00 00 00 00 00 00 00 00 00 06 16 16 16 ................ 2025-06-06 07:33:27 0010: 7E 14 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ~............... 2025-06-06 07:33:27 0020: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 2025-06-06 07:33:27 0030: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 2025-06-06 07:33:27 0040: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 2025-06-06 07:33:27 0050: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 2025-06-06 07:33:27 0060: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 2025-06-06 07:33:27 0070: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 2025-06-06 07:33:27 0080: 12 00 00 00 96 69 B4 1E 93 92 02 C8 A8 C0 06 08 .....i.......... 2025-06-06 07:33:27 0090: 00 00 00 00 00 00 ...... 2025-06-06 07:33:27 06809.135 2025-06-06 07:33:27 HOSTAPD: <0>22.22.22.6:5246<0-0> STA 96:69:b4:1e:93:92 IEEE 802.1X: start accounting with IP 192.168.200.2 sta ippro to 806 2025-06-06 07:33:27 06809.136 2025-06-06 07:33:27 HOSTAPD: <0>22.22.22.6:5246<0-0> STA 96:69:b4:1e:93:92 RADIUS: starting accounting session 68245D2800000468 2025-06-06 07:33:27 06809.136 2025-06-06 07:33:27 No accounting server configured for 22.22.22.6/5246-TKM-WPA3, do not send ACCT START for 96:69:b4:1e:93:92 2025-06-06 07:33:27 06809.136 2025-06-06 07:33:27 HOSTAPD: <0>22.22.22.6:5246<0-0> Received C2E_STA_IPADDR (150 bytes) from /tmp/cwCwAcSocket 2025-06-06 07:33:27 Received data - hexdump(len=150): 2025-06-06 07:33:27 0000: 0E 02 00 00 00 00 00 00 00 00 00 00 06 16 16 16 ................ 2025-06-06 07:33:27 0010: 7E 14 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ~............... 2025-06-06 07:33:27 0020: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 2025-06-06 07:33:27 0030: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 2025-06-06 07:33:27 0040: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 2025-06-06 07:33:27 0050: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 2025-06-06 07:33:27 0060: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 2025-06-06 07:33:27 0070: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 2025-06-06 07:33:27 0080: 12 00 00 00 96 69 B4 1E 93 92 02 C8 A8 C0 01 00 .....i.......... 2025-06-06 07:33:27 0090: 00 00 00 00 00 00 ...... 2025-06-06 07:33:27 06809.138 2025-06-06 07:33:27 HOSTAPD: <0>22.22.22.6:5246<0-0> STA 96:69:b4:1e:93:92 IEEE 802.1X: start accounting with IP 192.168.200.2 sta ippro to 1 2025-06-06 07:33:27 06809.138 2025-06-06 07:33:27 HOSTAPD: <0>22.22.22.6:5246<0-0> STA 96:69:b4:1e:93:92 RADIUS: starting accounting session 68245D2800000468 2025-06-06 07:33:27 06809.139 2025-06-06 07:33:27 No accounting server configured for 22.22.22.6/5246-TKM-WPA3, do not send ACCT START for 96:69:b4:1e:93:92 2025-06-06 07:33:27 06809.179 2025-06-06 07:33:27 HOSTAPD: <0>22.22.22.6:5246<0-0> Received C2E_STA_IPADDR (150 bytes) from /tmp/cwCwAcSocket 2025-06-06 07:33:27 Received data - hexdump(len=150): 2025-06-06 07:33:27 0000: 0E 02 00 00 00 00 00 00 00 00 00 00 06 16 16 16 ................ 2025-06-06 07:33:27 0010: 7E 14 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ~............... 2025-06-06 07:33:27 0020: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 2025-06-06 07:33:27 0030: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 2025-06-06 07:33:27 0040: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 2025-06-06 07:33:27 0050: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 2025-06-06 07:33:27 0060: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 2025-06-06 07:33:27 0070: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 2025-06-06 07:33:27 0080: 12 00 00 00 96 69 B4 1E 93 92 02 C8 A8 C0 01 00 .....i.......... 2025-06-06 07:33:27 0090: 00 00 00 00 00 00 ...... 2025-06-06 07:33:27 06809.181 2025-06-06 07:33:27 HOSTAPD: <0>22.22.22.6:5246<0-0> STA 96:69:b4:1e:93:92 IEEE 802.1X: start accounting with IP 192.168.200.2 sta ippro to 1 2025-06-06 07:33:27 06809.181 2025-06-06 07:33:27 HOSTAPD: <0>22.22.22.6:5246<0-0> STA 96:69:b4:1e:93:92 RADIUS: starting accounting session 68245D2800000468 2025-06-06 07:33:27 06809.182 2025-06-06 07:33:27 No accounting server configured for 22.22.22.6/5246-TKM-WPA3, do not send ACCT START for 96:69:b4:1e:93:92 2025-06-06 07:33:29 IEEE 802.1X: 96:69:b4:1e:93:92 - (EAP) retransWhile --> 0 2025-06-06 07:33:29 06811.732 2025-06-06 07:33:29 IEEE 802.1X: 96:69:b4:1e:93:92 Port Timers TICK (timers: 27 0 0) , pmkLifeTime:0 seconds 2025-06-06 07:33:56 IEEE 802.1X: 96:69:b4:1e:93:92 - aWhile --> 0 2025-06-06 07:33:56 06838.881 2025-06-06 07:33:56 IEEE 802.1X: 96:69:b4:1e:93:92 Port Timers TICK (timers: 0 0 0) , pmkLifeTime:0 seconds Example RADIUS captures downloaded from the FortiGate GUI: FortiGate IP address: 10.37.165.194 (RADIUS Client). FortiGuest IP address: 10.36.196.164 (RADIUS Server).   Note: As a best practice, ensure the FortiAP is running on the latest v7.4 or v7.6 GA firmware, as the newer versions contain WiFi stability fixes, and ensure the setup complies with the FortiAP and FortiOS compatibility matrix: FortiAP and FortiOS 7.x Compatibility Matrix Under SSID -> WiFi Settings, the 'Local vs RADIUS Server Authentication' difference is highlighted in this document: WiFi with WSSO using Windows NPS and user groups