file

Stores captured RADIUS messages in files. The file type is PcapNG.

PcapNG scope

File captures write only capture records that can be represented as network packets in PcapNG. They include RADIUS packets received from clients, replies sent to clients, and proxied backend packets.

File captures do not include internal application-layer records that have no transport metadata. This includes inner messages carried inside TLS-based EAP tunnels such as EAP-TTLS, PEAP, and TEAP. Use log capture output or EAP trace logging when you need to inspect inner EAP processing.

Configuration

• directory (required): Specifies where capture files should be stored.
• filename (optional): Specifies the exact filename for the capture file. When specified, all captured packets are written to this single file. When omitted, a separate file is automatically created for each authentication context, named <context_id>.pcapng where context_id is the hexadecimal authentication context ID.

Example

captures {
    # Capture to separate files per authentication context
    capture "CAPTURE_TO_DIRECTORY" {
        file {
            directory "/var/lib/radiator/captures";
        }
    }

    # Capture all packets to a single file
    capture "CAPTURE_TO_FILE" {
        file {
            directory "/var/lib/radiator/captures";
            filename "radiator-server.pcapng";
        }
    }
}

When troubleshooting authentication issues, you can correlate authentication log entries with their corresponding capture files using the Context-Id:

% sudo tail -1 radiator-server-authentication.log | jq -r '.["Context-Id"]'
abc123def456789a
% sudo ls -l /var/lib/radiator/captures/abc123def456789a.pcapng
-rw-r----- 1 radiator radiator 41256 Jun  5 09:23 /var/lib/radiator/captures/abc123def456789a.pcapng