AuthHound

RADIUS attribute 31 · type string

Calling-Station-Id

Calling-Station-Id (attribute 31) is the MAC address of the device that's connecting. It's how you identify endpoints for MAB — and its inconsistent formatting is why MAB matches break.

Also searched as: client MAC attribute, Calling-Station-ID. Defined in RFC 2865.

What it means

On 802.1X and MAB, Calling-Station-Id is the client's hardware address. It is the anchor for MAC Authentication Bypass, per-device policy, and correlating a session to a physical endpoint. The catch is format: one vendor sends aa-bb-cc-dd-ee-ff, another sends aabb.ccdd.eeff, another uppercase with colons — so a policy that matches one switch's format misses another's.

How it's used

Normalise the format before matching (strip separators, fold case). For MAB, the same MAC usually also appears as the username. Called-Station-Id is the matching attribute for the network side (AP/SSID or switch port).

Common gotchas

  • MAC format is vendor-specific and not case-consistent. A MAB allow-list that works on one switch family can reject the identical device on another purely because of separators or case.

Seeing this attribute in a reject or an accept that behaves wrong? Paste the full log into the analyzer — it runs in your browser, nothing is uploaded, and it ranks the likely causes for your specific output.

Related

When a NAS quietly stops honoring an attribute across a fleet, nobody sees it until users complain. AuthHound is building monitoring that tracks the attributes your servers actually return — early access:

No spam, no sharing — one email when it's ready, and you can reply to be removed anytime.