duplicate_detection

Selects how a RADIUS UDP server identifies retransmitted requests. This parameter has no effect on TCP or TLS listeners.

servers {
    radius "RADIUS_UDP" {
        listen {
            protocol udp;
            port 1812;
            ip 0.0.0.0;
        }
        duplicate_detection rfc5080;
        clients "RADIUS_CLIENTS";
    }
}

Allowed values:

• rfc5080 uses the client source IP address and UDP port, RADIUS Identifier, and receiving socket as the cache slot. A different valid Request Authenticator replaces the generation in that slot. The same Request Authenticator identifies a retransmission even if the packet contents have changed. Radiator does not compare the remaining packet contents in this mode.
• exact-packet requires the complete packet bytes to match. A packet with the same source, Identifier, and Request Authenticator but different contents starts a new request. Use this mode only when troubleshooting client retransmission behavior. It does not implement the duplicate identity from RFC 5080.

Default: rfc5080.

The exact-packet mode retains the complete request packet for each live cache entry and therefore uses more memory than rfc5080.

In both modes, Radiator silently discards a duplicate while the original request is being processed or its response is waiting for socket transmission. After the original response has been sent successfully, Radiator resends the cached response without running another AAA flow.

Radiator does not retain cache entries for invalid packets, unsupported packet types, or missing policies. Pipeline errors that produce no response and an intentional discard result use the shorter negative_timeout.

Use max_entries to bound memory use. Use timeout to set the normal response lifetime. Configure these values in the duplicate_cache block.