RADIUS-DYNAUTH-CLIENT-MIB

MIB Reference — IPNetwork Monitor · Updated October 06, 2026

All MIBs › RADIUS-DYNAUTH-CLIENT-MIB

Organization: IETF RADEXT Working Group

Last Updated: 2006-08-29

Category: RADIUS and AAA

Description: Defines managed objects for monitoring RADIUS Dynamic Authorization Clients, tracking Disconnect and Change-of-Authorization (CoA) message statistics.

IPNetwork Monitor uses several OIDs from this MIB in network discovery and polling the applicable devices. Start monitoring RADIUS-DYNAUTH-CLIENT-MIB with a free 30-day trial of IPNetwork Monitor.

What Is RADIUS-DYNAUTH-CLIENT-MIB?

RADIUS-DYNAUTH-CLIENT-MIB is an IETF standards-based MIB (RFC 4672) for monitoring the client side of RADIUS Dynamic Authorization Extensions, which let a RADIUS server send unsolicited Disconnect-Request and Change-of-Authorization (CoA) messages to dynamically terminate or alter an already-authenticated session. It belongs to the network access/AAA protocol area and exposes per-server and aggregate statistics on Disconnect and CoA message exchanges. Its monitoring relevance is protocol/software health: counters for invalid server addresses, round-trip time, and total Disconnect/CoA request counts reveal whether dynamic session-control messages are being processed correctly by the network access device acting as the dynamic-authorization client, which matters for use cases like forcibly disconnecting a misbehaving Wi-Fi or VPN client. It is explicitly an extension to the base RADIUS protocol (RFC 2865) dynamic-authorization framework defined alongside RFC 3576/5176. It is typically deployed on network access servers -- wireless controllers, VPN gateways, or switches -- that accept dynamic disconnect/CoA commands from a RADIUS/AAA policy server, making the RADIUS-DYNAUTH-CLIENT-MIB MIB a key reference for monitoring these dynamic authorization exchanges.

IPNetwork Monitor allows you to monitor SNMP objects defined in RADIUS-DYNAUTH-CLIENT-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

  • wireless LAN controller
  • VPN gateway
  • network access switch/router with RADIUS dynamic authorization support
  • vendor-neutral IETF standards-based MIB, not tied to a specific manufacturer

Monitoring Examples

An administrator would poll radiusDynAuthClientDisconInvalidServerAddresses and radiusDynAuthClientCoAInvalidServerAddresses to detect Disconnect or CoA messages arriving from unrecognized RADIUS servers, a potential misconfiguration or spoofing indicator. radiusDynAuthServerTable/radiusDynAuthServerEntry, keyed by radiusDynAuthServerIndex with radiusDynAuthServerAddressType/radiusDynAuthServerAddress and radiusDynAuthServerClientPortNumber, would be checked to confirm which authorization servers are configured, while radiusDynAuthClientRoundTripTime reveals response latency to those servers. Rising radiusDynAuthClientDisconRequests or radiusDynAuthClientDisconAuthOnlyRequests counts without corresponding successful disconnects would indicate the client device is failing to act on legitimate session-termination commands.

What Can Be Monitored

  • invalid server address counts (Disconnect/CoA)
  • configured dynamic-auth server address and port
  • round-trip time to authorization server
  • Disconnect request counts
  • Disconnect auth-only request counts
Imported Objects

From INET-ADDRESS-MIB

InetAddress
InetAddressType
InetPortNumber

From SNMP-FRAMEWORK-MIB

SnmpAdminString

From SNMPv2-CONF

MODULE-COMPLIANCE
OBJECT-GROUP

From SNMPv2-SMI

Counter32
Gauge32
Integer32
MODULE-IDENTITY
OBJECT-TYPE
TimeTicks
mib-2

How to Use in IPNetwork Monitor

Example using radiusDynAuthClientDisconInvalidServerAddresses OID:

Select a wireless LAN controller/VPN gateway/network access switch (RADIUS dynamic authorization client, RFC 4672) as the target host to create a monitor — the SNMP service should be up and running on it. Click New Monitor, then check SNMP Custom on the Favorites tab, click Next, and confirm the host. On the next page, click Select... to open the built-in SNMP MIB Browser and type radiusDynAuthClientDisconInvalidServerAddresses into the Find box to locate it in the OID tree, then select it and click OK. The number of Disconnect-Ack and Disconnect-NAK packets received from unknown addresses. On the monitor's Main parameters page you can set the target's SNMP port (default 161), credentials, polling interval, and other settings — see the SNMP Monitor help for details. On the State conditions and Alerting tabs, configure when the monitor should change state and trigger an alert; since this is a Counter32-type OID, Value bounds is the most useful condition here — trigger an alert if the counter increases sharply between polls relative to its normal baseline, since an unexpected spike often reflects a real change in traffic or activity. Click Finish to create the monitor; you can adjust any parameter later.
OIDs

RFC description

Defined in RFC 4673, manages RADIUS Dynamic Authorization (CoA/Disconnect) client implementation; monitors dynamic authorization requests and responses.

Start monitoring wireless LAN controller/VPN gateway/network access switch (RADIUS dynamic authorization client, RFC 4672) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download RADIUS-DYNAUTH-CLIENT-MIB