AuthHound

RADIUS attribute 25 · type octets

Class

Class (attribute 25) is an opaque token the RADIUS server sets on accept and the NAS returns verbatim in accounting. It's the intended way to tie a login to its accounting and session records.

Also searched as: RADIUS Class attribute, accounting correlation attribute. Defined in RFC 2865.

What it means

The server can put anything in Class — a policy name, a session key, a correlation ID — and RFC 2865 requires the NAS to send it back unmodified in every Accounting-Request for that session. That makes Class the clean join key between the authentication event and the accounting/usage records, without stuffing identifiers into user-visible fields.

How it's used

Set a correlation value on Access-Accept and read it back from accounting. Treat the contents as opaque bytes; don't assume it's printable text.

Common gotchas

  • Some NAS devices truncate or drop Class if it's too long or if multiple Class attributes are sent; keep it short and test that accounting echoes it.

Prove what the server actually returned: the open-source authhound-probe prints every authorization attribute in the Access-Accept and asserts the one you care about — a silently ignored attribute becomes a hard FAIL. 

export AUTHHOUND_RADIUS_SECRET='shared-secret'   # not in argv or shell history
authhound-probe radius test --server radius.corp.com --peap alice --expect-attr Filter-Id=staff

Recipe: assert returned attributes with --expect-vlan / --expect-attr

Related

When a NAS quietly stops honoring an attribute across a fleet, nobody sees it until users complain. AuthHound is building monitoring that tracks the attributes your servers actually return — early access:

No spam, no sharing — one email when it's ready, and you can reply to be removed anytime.