Find where Wi-Fi and RADIUS auth breaks
A RADIUS server — cloud or self-hosted — only logs the requests that reach it. The failures that burn days — a firewall eating UDP, a wrong secret on one switch, a certificate that expired overnight, a policy that never matches — happen in the hops nobody can see. AuthHound's free tools make them visible.
Two free tools, one blind spot
radiusd -X output or a
Windows NPS event and get a plain-English diagnosis: the failure stage, the
three most likely causes ranked, and one concrete next check for each. Runs
entirely in your browser.
radiusd
log) looks clean but users still can't connect. Run a real
PEAP-MSCHAPv2 or EAP-TLS login from inside
your network and get a plain-English verdict with the next thing to check —
no eapol_test hex to decode. It finds what no server-side tool
can: a firewall dropping the large packets EAP-TLS needs (path-MTU probing),
a server still soft on BlastRADIUS, auth succeeding onto the wrong VLAN.
Reachability, shared-secret, cert-expiry, and PAP checks included. Works
with FreeRADIUS, NPS, and cloud RADIUS. Free and open source.
Built from real tickets
The diagnoses encode years of vendor-side RADIUS support pattern-matching: the same handful of failures — wrong shared secrets, untrusted certificates, MSCHAPv2 vs password-hash mismatches, policies that never match — cause the vast majority of 802.1X outages. The analyzer's rules are open source and reviewable, and the CLI runs the exact same ones.
Continuous monitoring — coming
Running a tool by hand tells you what's broken right now. The failures that hurt most are the intermittent ones — the 3am blip, the cert expiring next Tuesday, latency creeping up under load — and you can't catch those by checking when you happen to suspect trouble.
AuthHound is becoming continuous monitoring that runs these checks from every site and tells you the moment something drifts, before your users complain. Leave your work email below — I read every signup and reply personally.
No spam, no sharing — one email when it's ready, maybe one question about what broke.
Common RADIUS & NPS failures, explained
- EAP succeeds but Wi-Fi won't connect — MPPE keys stripped by the proxy
The RADIUS log shows a clean EAP success, yet the client never associates on WPA2-Enterprise. The access point never got the session keys — a RADIUS proxy dropped the MS-MPPE-Send/Recv-Key VSAs, or a shared-secret mismatch corrupted them.
- FreeRADIUS 'certificate expired' TLS alert — server or client cert?
Diagnosing expired-certificate failures in radiusd -X: everyone failing at once means the server certificate; one device means a client cert or its clock. Commands to check both.
- FreeRADIUS 'invalid Message-Authenticator' — shared secret
Why FreeRADIUS drops packets with an invalid Message-Authenticator, how to find which clients.conf entry is actually being used, and the NAT trap that keeps this error alive after you've fixed the secret.
- FreeRADIUS 'Login incorrect' — find the real reason in radiusd -X
'Login incorrect' is the summary line, not the diagnosis. How to walk a FreeRADIUS debug log backwards from the reject to the module that actually failed, with the patterns to grep for.
- FreeRADIUS 'MS-CHAP2-Response is incorrect' — the real causes
What the mschap FAILED error in radiusd -X really means: the TLS tunnel is fine, and the inner MSCHAPv2 check failed — because of the password, the stored hash format, or the AD account state.
- FreeRADIUS 'No known good password' — nothing to check against
What 'Failed to find known good password' in radiusd -X means: no authorize module supplied a password, the stored hash is incompatible with the auth method, or the lookup silently missed.
- FreeRADIUS 'TLS Alert unknown CA' — client distrusts your cert
What the unknown CA alert in radiusd -X debug output means, why the client (not the server) is rejecting the handshake, and the three trust problems that cause it.
- FreeRADIUS 'unknown client' — why the NAS times out, not fails
What it means when radiusd -X shows 'Ignoring request to auth address from unknown client': the missing clients.conf entry, multi-homed NAS source IPs, and why the client side only sees timeouts.
- FreeRADIUS EAP stalls mid-handshake — the fragment-size fix
Why 802.1X authentications hang partway through the TLS handshake: oversized RADIUS packets carrying certificate fragments get dropped, the NAS retransmits, and the client never answers. Diagnosis and the fragment_size fix.
- FreeRADIUS rlm_ldap bind failed — admin bind vs user bind
Troubleshooting 'LDAP bind failed' errors in FreeRADIUS: wrong bind DN credentials, LDAPS/StartTLS certificate trust, unreachable directory, and the difference between the service bind and per-user authentication binds.
- FreeRADIUS TLS version mismatch — tls_min_version & old devices
Diagnosing generic TLS handshake failures in radiusd -X: printers and embedded devices stuck on TLS 1.0/1.1 against servers enforcing TLS 1.2+, cipher mismatches, and users cancelling trust prompts.
- MAC Authentication Bypass not working — why MAB is rejected
A printer or camera on MAB gets rejected or mis-VLANed while 802.1X users work. Usually the MAC-address format doesn't match your allow-list, or the policy keys on the wrong Service-Type — MAB arrives as Call-Check, not a normal user login.
- NPS Event 6273 Reason Code 16 — often not the password
What 'Authentication failed due to a user credentials mismatch' actually means in Windows NPS, the three causes that produce it, and the exact fields in the event that tell you which one you have.
- NPS Event 6273 Reason Code 22 — 'EAP type cannot be processed'
Why NPS rejects clients with 'the EAP type cannot be processed by the server' — expired NPS certificates, PEAP vs EAP-TLS mismatches, and corrupted EAP policy config.
- NPS Event 6273 Reason Code 23 — EAP error = your NPS certificate
Decoding NPS Reason Code 23: why 'check EAP log files' almost always means the NPS server's own certificate is expired, missing its private key, or failing revocation checks.
- NPS Event 6273 Reason Code 262 — 'signature not verified' = secret
Why 'The supplied message is incomplete. The signature was not verified' in Windows NPS is a shared secret mismatch, and how to find which RADIUS client entry is at fault.
- NPS Event 6273 Reason Code 36 — account locked out by the Wi-Fi
Why NPS rejects with 'the account is locked out', how a stale cached Wi-Fi password causes the lockout loop, and the neighboring reason codes 34, 35, 37, 38 for disabled/expired accounts.
- NPS Event 6273 Reason Code 48 — no network policy matched
Why 'The connection request did not match any configured network policy' happens even when the user and password are right: group scoping, computer vs user objects, NAS Port Type conditions, and policy ordering.
- NPS Event 6273 Reason Code 49 — no connection request policy
What it means when a RADIUS request fails to match any NPS connection request policy: deleted default CRPs, day/time and NAS conditions, and proxy realm rules.
- NPS Event 6273 Reason Code 65 — denied by dial-in permission
Why one user gets rejected by NPS while everyone else connects: the AD account's Dial-in tab set to Deny access, the msNPAllowDialin attribute, and the policy checkbox that overrides it.
- NPS Event 6273 Reason Code 66 — auth method not enabled
Decoding 'the user attempted to use an authentication method that is not enabled on the matching network policy': EAP mismatches mid-migration, non-EAP fallbacks, and requests matching the wrong policy.
- NPS Event 6273 Reason Code 7 — 'the specified domain does not exist'
Why NPS says the domain does not exist: usernames with the wrong realm, personal email addresses typed as identities, NetBIOS vs DNS domain names, and DC locator failures.
- NPS Event 6273 Reason Code 8 — 'user account does not exist' (it does)
Why Windows NPS says the specified user account does not exist even when you can see it in AD: username format mismatches, host/ machine identities, and cross-domain lookups.
- NPS Event 6274 'discarded the request' — not a reject
The difference between NPS event 6273 (denied) and 6274 (discarded), and the causes of discards: unverifiable packets, malformed requests, and accounting problems.
- NPS Reason Code 48 vs 49 — which policy layer rejected you
The two 'no policy matched' rejects in Windows NPS compared: connection request policies vs network policies, how to tell them apart in seconds, and which console tab to open for each.
- PEAP-MSCHAPv2 to EAP-TLS migration without breaking Wi-Fi
A staged migration plan from password-based PEAP to certificate-based EAP-TLS: why NTLM hardening is forcing the move, the dual-policy transition pattern, and the reason codes you'll see when a device is mid-migration.
- RADIUS dynamic VLAN not working — device lands on the default VLAN
802.1X authenticates but the device stays on the native/default VLAN. The usual cause is the RADIUS policy returning only Tunnel-Private-Group-Id without the two companion attributes — plus the VLAN-doesn't-exist and wrong-type traps.
- RADIUS Filter-Id not applied — the ACL name the NAS quietly ignores
The Access-Accept carries Filter-Id (or a Cisco-AVPair/Aruba role) but the ACL never takes effect. Almost always the named filter doesn't exist on the NAS, or the name doesn't match exactly — RADIUS sends the label, not the rules.
- RADIUS server not responding — silent failures, in likelihood order
When the NAS reports RADIUS timeouts instead of rejects: silent drops from unknown clients and bad secrets, dropped UDP fragments mid-EAP, dead services, and firewalled or wrong ports — with the checks for each.