5 ms·

Have two questions after reading the article 1) What are DNS logs? 2) What are RADIUS logs? Would someone be so good as to answer? Thanks in advance for hel

Have two questions after reading the article 1) What are DNS logs? 2) What are RADIUS logs? Would someone be so good as to answer? Thanks in advance for help you could provide. Edit :- This got downvoted. Don’t know why should anyone asking an honest question be marked down. Am I not allowed to ask technical questions in comments section?

godelmachine 8y ago
Did a quick Google search. Found this. Is it relevant to RADIUS logs I asked above? https://en.m.wikipedia.org/wiki/RADIUS https://en.m.wikipedia.org/wiki/RADIUS
- detaro 8y ago
  yes, it's that RADIUS. Their WLAN access points use that protocol to check if a username/password they're given is acceptable.
geek_at 8y ago
Every time a device joins the corp. network, it gets an IP Address (DHCP) and a network name (DNS) from our servers. RADIUS is the authentication method for wifi. In larger offices you don't just share the same password for all users, but rather set up a RADIUS server that manages individual accounts. So every employee has their own username and password for wifi. Also called WPA2 Enterprise
- danesparza 8y ago
  RADIUS predates wifi by a few years. :-) It was originally centralized authentication for dial-in systems: https://en.wikipedia.org/wiki/RADIUS https://en.wikipedia.org/wiki/RADIUS
_nalply 8y ago
I didn't downvote you. Perhaps the downvoters did that because they felt your post not interesting enough. Read the guidelines (link at the bottom of the start page), especially: > On-Topic: Anything that good hackers would find interesting. Something which is common hacker's knowledge and easily googleable is probably boring.
- beaconstudios 8y ago
  that's for posts, not comments.
taco_emoji 8y ago
You probably got downvoted because you can just use Google to answer those questions.
- godelmachine 8y ago
  I don’t think I broke any HN rules. Did I?
- neetodavid 8y ago
  I appreciate having the question asked and answered right here in the comments. won't someone please think of the lurkers
chatmasta 8y ago
DNS logs -- logs of name lookups to the internal DNS server, which will include source IP of the DNS lookup (note: UDP, can be spoofed). Look up source IP in DHCP lease table to find hostname and mac address of device on wifi that is assigned that source IP. RADIUS logs -- RADIUS = AAA server (authorization, authentication, accounting). Basically, a server that answers the question "given these credentials, what resources can this user access?" All new connections to the network will show up in RADIUS logs. As a user, when you have your "own" wifi username and password (e.g. on an access point configured to use WPA Enterprise), usually what happens is the access point asks an external RADIUS server to authenticate the credentials, and then the DHCP server asks the RADIUS server to authorize the user for an IP address assignment.

godelmachine 8y ago

Did a quick Google search. Found this. Is it relevant to RADIUS logs I asked above? https://en.m.wikipedia.org/wiki/RADIUS https://en.m.wikipedia.org/wiki/RADIUS

detaro 8y ago
yes, it's that RADIUS. Their WLAN access points use that protocol to check if a username/password they're given is acceptable.

geek_at 8y ago

Every time a device joins the corp. network, it gets an IP Address (DHCP) and a network name (DNS) from our servers. RADIUS is the authentication method for wifi. In larger offices you don't just share the same password for all users, but rather set up a RADIUS server that manages individual accounts. So every employee has their own username and password for wifi. Also called WPA2 Enterprise

danesparza 8y ago
RADIUS predates wifi by a few years. :-) It was originally centralized authentication for dial-in systems: https://en.wikipedia.org/wiki/RADIUS https://en.wikipedia.org/wiki/RADIUS

_nalply 8y ago

I didn't downvote you. Perhaps the downvoters did that because they felt your post not interesting enough. Read the guidelines (link at the bottom of the start page), especially: > On-Topic: Anything that good hackers would find interesting. Something which is common hacker's knowledge and easily googleable is probably boring.

beaconstudios 8y ago
that's for posts, not comments.

taco_emoji 8y ago

You probably got downvoted because you can just use Google to answer those questions.

godelmachine 8y ago
I don’t think I broke any HN rules. Did I?
neetodavid 8y ago
I appreciate having the question asked and answered right here in the comments. won't someone please think of the lurkers

chatmasta 8y ago

DNS logs -- logs of name lookups to the internal DNS server, which will include source IP of the DNS lookup (note: UDP, can be spoofed). Look up source IP in DHCP lease table to find hostname and mac address of device on wifi that is assigned that source IP. RADIUS logs -- RADIUS = AAA server (authorization, authentication, accounting). Basically, a server that answers the question "given these credentials, what resources can this user access?" All new connections to the network will show up in RADIUS logs. As a user, when you have your "own" wifi username and password (e.g. on an access point configured to use WPA Enterprise), usually what happens is the access point asks an external RADIUS server to authenticate the credentials, and then the DHCP server asks the RADIUS server to authorize the user for an IP address assignment.