From heas at shrubbery.net  Wed Dec  2 23:18:53 2015
From: heas at shrubbery.net (heasley)
Date: Wed, 2 Dec 2015 23:18:53 +0000
Subject: [tac_plus] possible bug?
In-Reply-To: <CAMwKYx3O0E4boqjmYmj8URebL4aeADi1zsusD5WxnjRqm1k7aw@mail.gmail.com>
References: <CAMwKYx3O0E4boqjmYmj8URebL4aeADi1zsusD5WxnjRqm1k7aw@mail.gmail.com>
Message-ID: <20151202231853.GL10132@shrubbery.net>

Mon, Nov 30, 2015 at 06:21:30PM +0000, Adam Dyess:
> packet.c line 150.
> 
> why would you get the *cfg_get_host_prompt *based on the hostname?  i
> believe it should be *cfg_get_host_key(session.peer).  *

I believe that you are correct.

Thanks.

From heas at shrubbery.net  Thu Dec  3 17:32:39 2015
From: heas at shrubbery.net (heasley)
Date: Thu, 3 Dec 2015 17:32:39 +0000
Subject: [tac_plus] possible bug?
In-Reply-To: <CAMwKYx1_YLYDdNd2YXpmUDaA4ymw2=wb146DmoL51FLm=Zachw@mail.gmail.com>
References: <CAMwKYx3O0E4boqjmYmj8URebL4aeADi1zsusD5WxnjRqm1k7aw@mail.gmail.com>
 <20151202231853.GL10132@shrubbery.net>
 <CAMwKYx1_YLYDdNd2YXpmUDaA4ymw2=wb146DmoL51FLm=Zachw@mail.gmail.com>
Message-ID: <20151203173239.GB88242@shrubbery.net>

Thu, Dec 03, 2015 at 02:13:03PM +0000, Adam Dyess:
> There's an analog to the line 150 at line 550 for encoding packets.  The
> same issue.
> Is this the proper way to enumerate found bugs or is there something I
> missed?

nope; I updated that as well.

> On Wed, Dec 2, 2015 at 5:18 PM heasley <heas at shrubbery.net> wrote:
> 
> > Mon, Nov 30, 2015 at 06:21:30PM +0000, Adam Dyess:
> > > packet.c line 150.
> > >
> > > why would you get the *cfg_get_host_prompt *based on the hostname?  i
> > > believe it should be *cfg_get_host_key(session.peer).  *
> >
> > I believe that you are correct.
> >
> > Thanks.
> >

From adam at adamdyess.com  Thu Dec  3 14:13:03 2015
From: adam at adamdyess.com (Adam Dyess)
Date: Thu, 03 Dec 2015 14:13:03 +0000
Subject: [tac_plus] possible bug?
In-Reply-To: <20151202231853.GL10132@shrubbery.net>
References: <CAMwKYx3O0E4boqjmYmj8URebL4aeADi1zsusD5WxnjRqm1k7aw@mail.gmail.com>
 <20151202231853.GL10132@shrubbery.net>
Message-ID: <CAMwKYx1_YLYDdNd2YXpmUDaA4ymw2=wb146DmoL51FLm=Zachw@mail.gmail.com>

There's an analog to the line 150 at line 550 for encoding packets.  The
same issue.
Is this the proper way to enumerate found bugs or is there something I
missed?

On Wed, Dec 2, 2015 at 5:18 PM heasley <heas at shrubbery.net> wrote:

> Mon, Nov 30, 2015 at 06:21:30PM +0000, Adam Dyess:
> > packet.c line 150.
> >
> > why would you get the *cfg_get_host_prompt *based on the hostname?  i
> > believe it should be *cfg_get_host_key(session.peer).  *
>
> I believe that you are correct.
>
> Thanks.
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://www.shrubbery.net/pipermail/tac_plus/attachments/20151203/74cdaa3c/attachment.html>

From adam at adamdyess.com  Thu Dec  3 18:47:50 2015
From: adam at adamdyess.com (Adam Dyess)
Date: Thu, 03 Dec 2015 18:47:50 +0000
Subject: [tac_plus] possible bug?
In-Reply-To: <20151203173239.GB88242@shrubbery.net>
References: <CAMwKYx3O0E4boqjmYmj8URebL4aeADi1zsusD5WxnjRqm1k7aw@mail.gmail.com>
 <20151202231853.GL10132@shrubbery.net>
 <CAMwKYx1_YLYDdNd2YXpmUDaA4ymw2=wb146DmoL51FLm=Zachw@mail.gmail.com>
 <20151203173239.GB88242@shrubbery.net>
Message-ID: <CAMwKYx1xiwgMQVa=UfuWq65wOfaH+n7Q+EfK8BPvxob1Pvkr-A@mail.gmail.com>

Thanks!

On Thu, Dec 3, 2015, 11:32 AM heasley <heas at shrubbery.net> wrote:

> Thu, Dec 03, 2015 at 02:13:03PM +0000, Adam Dyess:
> > There's an analog to the line 150 at line 550 for encoding packets.  The
> > same issue.
> > Is this the proper way to enumerate found bugs or is there something I
> > missed?
>
> nope; I updated that as well.
>
> > On Wed, Dec 2, 2015 at 5:18 PM heasley <heas at shrubbery.net> wrote:
> >
> > > Mon, Nov 30, 2015 at 06:21:30PM +0000, Adam Dyess:
> > > > packet.c line 150.
> > > >
> > > > why would you get the *cfg_get_host_prompt *based on the hostname?  i
> > > > believe it should be *cfg_get_host_key(session.peer).  *
> > >
> > > I believe that you are correct.
> > >
> > > Thanks.
> > >
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://www.shrubbery.net/pipermail/tac_plus/attachments/20151203/9c120184/attachment.html>

From contreras.juanj at gmail.com  Mon Dec  7 19:37:44 2015
From: contreras.juanj at gmail.com (Juan Contreras)
Date: Mon, 7 Dec 2015 11:37:44 -0800
Subject: [tac_plus] Download tac_plus
Message-ID: <CANf9zwEPTsiDCswkyqGVevqKpyWtoktHGjbH=_0Evj0xzYxEJA@mail.gmail.com>

Hi all,

I have been trying to download tac_plus for a while now but the link never
works for me. Whether i use ubuntu ftp or down load from my Windows
computer via chrome it never works. Is there another link or place where i
can download tac_plus?

Thank you!!

-Juan
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://www.shrubbery.net/pipermail/tac_plus/attachments/20151207/7ad8d261/attachment.html>

From alan.mckinnon at gmail.com  Tue Dec  8 06:08:21 2015
From: alan.mckinnon at gmail.com (Alan McKinnon)
Date: Tue, 8 Dec 2015 08:08:21 +0200
Subject: [tac_plus] Download tac_plus
In-Reply-To: <CANf9zwEPTsiDCswkyqGVevqKpyWtoktHGjbH=_0Evj0xzYxEJA@mail.gmail.com>
References: <CANf9zwEPTsiDCswkyqGVevqKpyWtoktHGjbH=_0Evj0xzYxEJA@mail.gmail.com>
Message-ID: <566673D5.90407@gmail.com>

On 07/12/2015 21:37, Juan Contreras wrote:
> Hi all,
> 
> I have been trying to download tac_plus for a while now but the link never
> works for me. Whether i use ubuntu ftp or down load from my Windows
> computer via chrome it never works. Is there another link or place where i
> can download tac_plus?


wget ftp://ftp.shrubbery.net/pub/tac_plus/tacacs+-F4.0.4.27a.tar.gz

That URI works. Some alternates:

ftp://ftp.is.co.za/mirror/gentoo.org/distfiles/tacacs+-F4.0.4.27a.tar.gz

http://distfiles.gentoo.org/distfiles/tacacs+-F4.0.4.27a.tar.gz




-- 
Alan McKinnon
alan.mckinnon at gmail.com


From wallance.hou at ericsson.com  Thu Dec 17 10:22:04 2015
From: wallance.hou at ericsson.com (Wallance Hou)
Date: Thu, 17 Dec 2015 10:22:04 +0000
Subject: [tac_plus] Regarding of an issue on tac_plus
Message-ID: <ED708375D7971545B71B0BDFFF0DC4DB3DA376CE@ESGSCMB101.ericsson.se>

Dear tac_plus Support,

I am using tac_plus(tacacs+-F4.0.4.26-1.proserve .el5.x86_64.rpm) with AAA service for my network. But it shown the below error when I configured accounting to tacacs server on Juniper and Extreme device. Would you kindly give me some advice? I appreciate it very much for your kindly feedback.

Thu Dec 17 18:07:49 2015 [13839]: Error 123.1.1.23: acct minimum payload: 258, got: 106

Thanks.
Wallance Hou
ITTE Infrastructure Ops
wallance.hou at ericsson.com<mailto:wallance.hou at ericsson.com>
Phone: 887 29303

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://www.shrubbery.net/pipermail/tac_plus/attachments/20151217/701554db/attachment.html>

From heas at shrubbery.net  Thu Dec 17 21:37:38 2015
From: heas at shrubbery.net (heasley)
Date: Thu, 17 Dec 2015 21:37:38 +0000
Subject: [tac_plus] Regarding of an issue on tac_plus
In-Reply-To: <ED708375D7971545B71B0BDFFF0DC4DB3DA376CE@ESGSCMB101.ericsson.se>
References: <ED708375D7971545B71B0BDFFF0DC4DB3DA376CE@ESGSCMB101.ericsson.se>
Message-ID: <20151217213738.GH98068@shrubbery.net>

Thu, Dec 17, 2015 at 10:22:04AM +0000, Wallance Hou:
> Dear tac_plus Support,
> 
> I am using tac_plus(tacacs+-F4.0.4.26-1.proserve .el5.x86_64.rpm) with AAA service for my network. But it shown the below error when I configured accounting to tacacs server on Juniper and Extreme device. Would you kindly give me some advice? I appreciate it very much for your kindly feedback.
> 
> Thu Dec 17 18:07:49 2015 [13839]: Error 123.1.1.23: acct minimum payload: 258, got: 106

An accounting record has a strict format and clearly an accounting record
was sent to the tacacs daemon that did not meet the requirements, too little
in this case.  assuming its from a network device, rather than a probe from
the internet, the device sending the record has a bug or the packet was
damaged in flight.

junos does not do tacacs account, afaik.  so, the extreme has a bug or a
packet was mangled in flight.  the daemon supports debug options to dump
packets, etc to syslog.

From wallance.hou at ericsson.com  Fri Dec 18 05:21:09 2015
From: wallance.hou at ericsson.com (Wallance Hou)
Date: Fri, 18 Dec 2015 05:21:09 +0000
Subject: [tac_plus] Regarding of an issue on tac_plus
In-Reply-To: <20151217213738.GH98068@shrubbery.net>
References: <ED708375D7971545B71B0BDFFF0DC4DB3DA376CE@ESGSCMB101.ericsson.se>
 <20151217213738.GH98068@shrubbery.net>
Message-ID: <ED708375D7971545B71B0BDFFF0DC4DB3DA37A9A@ESGSCMB101.ericsson.se>

Hi,

Thanks very much for your response. Actually, I configured tacacs+ accounting on SRX550 and Extreme Summit 450A and the same error log as below, btw the cisco devices always work perfectly. Doesn't it have any way to fix this issue or in newest tac_plus version?

Fri Dec 18 03:04:01 2015 [14830]: Error 123.1.2.24: acct minimum payload: 177, got: 54

Thanks.
Wallance Hou
ITTE Infrastructure Ops
wallance.hou at ericsson.com
Phone: 887 29303

-----Original Message-----
From: heasley [mailto:heas at shrubbery.net] 
Sent: Friday, December 18, 2015 5:38 AM
To: Wallance Hou
Cc: tac_plus at shrubbery.net
Subject: Re: [tac_plus] Regarding of an issue on tac_plus

Thu, Dec 17, 2015 at 10:22:04AM +0000, Wallance Hou:
> Dear tac_plus Support,
> 
> I am using tac_plus(tacacs+-F4.0.4.26-1.proserve .el5.x86_64.rpm) with AAA service for my network. But it shown the below error when I configured accounting to tacacs server on Juniper and Extreme device. Would you kindly give me some advice? I appreciate it very much for your kindly feedback.
> 
> Thu Dec 17 18:07:49 2015 [13839]: Error 123.1.1.23: acct minimum 
> payload: 258, got: 106

An accounting record has a strict format and clearly an accounting record was sent to the tacacs daemon that did not meet the requirements, too little in this case.  assuming its from a network device, rather than a probe from the internet, the device sending the record has a bug or the packet was damaged in flight.

junos does not do tacacs account, afaik.  so, the extreme has a bug or a packet was mangled in flight.  the daemon supports debug options to dump packets, etc to syslog.

From heas at shrubbery.net  Mon Dec 21 22:38:26 2015
From: heas at shrubbery.net (heasley)
Date: Mon, 21 Dec 2015 22:38:26 +0000
Subject: [tac_plus] Regarding of an issue on tac_plus
In-Reply-To: <ED708375D7971545B71B0BDFFF0DC4DB3DA37A9A@ESGSCMB101.ericsson.se>
References: <ED708375D7971545B71B0BDFFF0DC4DB3DA376CE@ESGSCMB101.ericsson.se>
 <20151217213738.GH98068@shrubbery.net>
 <ED708375D7971545B71B0BDFFF0DC4DB3DA37A9A@ESGSCMB101.ericsson.se>
Message-ID: <20151221223826.GK26865@shrubbery.net>

Fri, Dec 18, 2015 at 05:21:09AM +0000, Wallance Hou:
> Hi,
> 
> Thanks very much for your response. Actually, I configured tacacs+ accounting on SRX550 and Extreme Summit 450A and the same error log as below, btw the cisco devices always work perfectly. Doesn't it have any way to fix this issue or in newest tac_plus version?
> 
> Fri Dec 18 03:04:01 2015 [14830]: Error 123.1.2.24: acct minimum payload: 177, got: 54

Well, I do not know without understanding what your device is sending.
I believe that the packet debugging would output enough information to
determine if the device is omitting something or mangling the request.
If its mangling it, then the daemon is doing the right thing.

Either way, the correct fix is fixing whatever isnt following the tacacs
protocol draft.

> Thanks.
> Wallance Hou
> ITTE Infrastructure Ops
> wallance.hou at ericsson.com
> Phone: 887 29303
> 
> -----Original Message-----
> From: heasley [mailto:heas at shrubbery.net] 
> Sent: Friday, December 18, 2015 5:38 AM
> To: Wallance Hou
> Cc: tac_plus at shrubbery.net
> Subject: Re: [tac_plus] Regarding of an issue on tac_plus
> 
> Thu, Dec 17, 2015 at 10:22:04AM +0000, Wallance Hou:
> > Dear tac_plus Support,
> > 
> > I am using tac_plus(tacacs+-F4.0.4.26-1.proserve .el5.x86_64.rpm) with AAA service for my network. But it shown the below error when I configured accounting to tacacs server on Juniper and Extreme device. Would you kindly give me some advice? I appreciate it very much for your kindly feedback.
> > 
> > Thu Dec 17 18:07:49 2015 [13839]: Error 123.1.1.23: acct minimum 
> > payload: 258, got: 106
> 
> An accounting record has a strict format and clearly an accounting record was sent to the tacacs daemon that did not meet the requirements, too little in this case.  assuming its from a network device, rather than a probe from the internet, the device sending the record has a bug or the packet was damaged in flight.
> 
> junos does not do tacacs account, afaik.  so, the extreme has a bug or a packet was mangled in flight.  the daemon supports debug options to dump packets, etc to syslog.

From wallance.hou at ericsson.com  Tue Dec 22 03:04:16 2015
From: wallance.hou at ericsson.com (Wallance Hou)
Date: Tue, 22 Dec 2015 03:04:16 +0000
Subject: [tac_plus] Regarding of an issue on tac_plus
In-Reply-To: <20151221223826.GK26865@shrubbery.net>
References: <ED708375D7971545B71B0BDFFF0DC4DB3DA376CE@ESGSCMB101.ericsson.se>
 <20151217213738.GH98068@shrubbery.net>
 <ED708375D7971545B71B0BDFFF0DC4DB3DA37A9A@ESGSCMB101.ericsson.se>
 <20151221223826.GK26865@shrubbery.net>
Message-ID: <ED708375D7971545B71B0BDFFF0DC4DB3DA389AC@ESGSCMB101.ericsson.se>

Hi,

Thank you always for you patient support. I have enabled package debug level and got the log as attached. But I can't understand it. Would you kindly point it out where goes wrong?

Thanks.
Wallance Hou
ITTE Infrastructure Ops
wallance.hou at ericsson.com
Phone: 887 29303

-----Original Message-----
From: heasley [mailto:heas at shrubbery.net] 
Sent: Tuesday, December 22, 2015 6:38 AM
To: Wallance Hou
Cc: heasley; tac_plus at shrubbery.net
Subject: Re: [tac_plus] Regarding of an issue on tac_plus

Fri, Dec 18, 2015 at 05:21:09AM +0000, Wallance Hou:
> Hi,
> 
> Thanks very much for your response. Actually, I configured tacacs+ accounting on SRX550 and Extreme Summit 450A and the same error log as below, btw the cisco devices always work perfectly. Doesn't it have any way to fix this issue or in newest tac_plus version?
> 
> Fri Dec 18 03:04:01 2015 [14830]: Error 123.1.2.24: acct minimum 
> payload: 177, got: 54

Well, I do not know without understanding what your device is sending.
I believe that the packet debugging would output enough information to determine if the device is omitting something or mangling the request.
If its mangling it, then the daemon is doing the right thing.

Either way, the correct fix is fixing whatever isnt following the tacacs protocol draft.

> Thanks.
> Wallance Hou
> ITTE Infrastructure Ops
> wallance.hou at ericsson.com
> Phone: 887 29303
> 
> -----Original Message-----
> From: heasley [mailto:heas at shrubbery.net]
> Sent: Friday, December 18, 2015 5:38 AM
> To: Wallance Hou
> Cc: tac_plus at shrubbery.net
> Subject: Re: [tac_plus] Regarding of an issue on tac_plus
> 
> Thu, Dec 17, 2015 at 10:22:04AM +0000, Wallance Hou:
> > Dear tac_plus Support,
> > 
> > I am using tac_plus(tacacs+-F4.0.4.26-1.proserve .el5.x86_64.rpm) with AAA service for my network. But it shown the below error when I configured accounting to tacacs server on Juniper and Extreme device. Would you kindly give me some advice? I appreciate it very much for your kindly feedback.
> > 
> > Thu Dec 17 18:07:49 2015 [13839]: Error 123.1.1.23: acct minimum
> > payload: 258, got: 106
> 
> An accounting record has a strict format and clearly an accounting record was sent to the tacacs daemon that did not meet the requirements, too little in this case.  assuming its from a network device, rather than a probe from the internet, the device sending the record has a bug or the packet was damaged in flight.
> 
> junos does not do tacacs account, afaik.  so, the extreme has a bug or a packet was mangled in flight.  the daemon supports debug options to dump packets, etc to syslog.
-------------- next part --------------
An embedded and charset-unspecified text was scrubbed...
Name: tac_plus-debug-package.txt
URL: <http://www.shrubbery.net/pipermail/tac_plus/attachments/20151222/cc30aead/attachment.txt>

From heas at shrubbery.net  Wed Dec 30 01:16:02 2015
From: heas at shrubbery.net (heasley)
Date: Wed, 30 Dec 2015 01:16:02 +0000
Subject: [tac_plus] Regarding of an issue on tac_plus
In-Reply-To: <ED708375D7971545B71B0BDFFF0DC4DB3DA389AC@ESGSCMB101.ericsson.se>
References: <ED708375D7971545B71B0BDFFF0DC4DB3DA376CE@ESGSCMB101.ericsson.se>
 <20151217213738.GH98068@shrubbery.net>
 <ED708375D7971545B71B0BDFFF0DC4DB3DA37A9A@ESGSCMB101.ericsson.se>
 <20151221223826.GK26865@shrubbery.net>
 <ED708375D7971545B71B0BDFFF0DC4DB3DA389AC@ESGSCMB101.ericsson.se>
Message-ID: <20151230011602.GK60026@shrubbery.net>

Tue, Dec 22, 2015 at 03:04:16AM +0000, Wallance Hou:
> Tue Dec 22 10:47:13 2015 [14002]: connect from 12.12.151.142 [12.12.151.142]
> Tue Dec 22 10:47:13 2015 [14002]: Read ACCT size=100
> Tue Dec 22 10:47:13 2015 [14002]: validation request from 12.12.151.142
> Tue Dec 22 10:47:13 2015 [14002]: version 192 (0xc0), type 3, seq no 1, flags 0x0
> Tue Dec 22 10:47:13 2015 [14002]: session_id 4028064090 (0xf017615a), Data length 88 (0x58)

The data length of the ACCT packet, not including the 12 byte header, is
88 bytes.  it read 100 bytes.

> Tue Dec 22 10:47:13 2015 [14002]: End header
> Tue Dec 22 10:47:13 2015 [14002]: ACCT, flags=0xfd method=90 priv_lvl=251
> Tue Dec 22 10:47:13 2015 [14002]: type=82 svc=118
> Tue Dec 22 10:47:13 2015 [14002]: user_len=146 port_len=44 rem_addr_len=76
> Tue Dec 22 10:47:13 2015 [14002]: arg_cnt=89

89 arguments; with one byte for each argument's length, that already exceeds
the length of the data portion of the packet.  It is probably using
uninitialized memory when creating the packet.  You can report that to the
vendor.

> Tue Dec 22 10:47:13 2015 [14002]: User: 
> Tue Dec 22 10:47:13 2015 [14002]:  0x0  0x0  0x98  0x10 ' 0xc8  0xaa  0x7f  0x0  0x0  0x98  0x10 ' 0xc8  0xaa  0x7f  0x0  0x0   0x0  0x0  0x0  0x0  0x0  0x0  0x0 0 0x0  0x0  0x0 
> Tue Dec 22 10:47:13 2015 [14002]: port: 
> Tue Dec 22 10:47:13 2015 [14002]:  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0 
> Tue Dec 22 10:47:13 2015 [14002]: rem_addr: 
> Tue Dec 22 10:47:13 2015 [14002]:  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0 
> Tue Dec 22 10:47:13 2015 [14002]: arg[0]: size=199 
> Tue Dec 22 10:47:13 2015 [14002]:  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0 
> Tue Dec 22 10:47:13 2015 [14002]: arg[1]: size=27 
> Tue Dec 22 10:47:13 2015 [14002]:  0x0 acl_cnshte 0x0  0xc8 
> Tue Dec 22 10:47:13 2015 [14002]: arg[2]: size=3 
> Tue Dec 22 10:47:13 2015 [14002]: 
> Tue Dec 22 10:47:13 2015 [14002]: arg[3]: size=120 
> Tue Dec 22 10:47:13 2015 [14002]:  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x3  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0 
> Tue Dec 22 10:47:13 2015 [14002]: arg[4]: size=75 
> Tue Dec 22 10:47:13 2015 [14002]:  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0 
> Tue Dec 22 10:47:13 2015 [14002]: arg[5]: size=194 
> Tue Dec 22 10:47:13 2015 [14002]:  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0 
> Tue Dec 22 10:47:13 2015 [14002]: arg[6]: size=239 
> Tue Dec 22 10:47:13 2015 [14002]: | 0x1  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0xe0 K| 0x1  0x0  0x0  0x0  0x0  0x80  0xaa | 0x1  0x0  0x0  0x0  0x0  0xc0  0xab | 0x1  0x0  0x0  0x0  0x0  0x0  0xad | 0x1  0x0  0x0  0x0  0x0 ` 0xae | 0x1  0x0  0x0 
> Tue Dec 22 10:47:13 2015 [14002]: arg[7]: size=234 
> Tue Dec 22 10:47:13 2015 [14002]:  0x0  0x0  0x0 | 0x0  0x0  0x0  0x1  0x0  0x0  0x1  0x0  0x0  0x0  0x0 1 0x0  0x0  0x0 | 0x0  0x0  0x0  0x1  0x0 @ 0x1  0x0  0x0  0x0  0x0 7 0x0  0x0  0x0 | 0x0  0x0  0x0  0x1  0x0 @ 0x1  0x0  0x0  0x0  0x0 5 0x0  0x0  0x0 | 0x0 
> Tue Dec 22 10:47:13 2015 [14002]: arg[8]: size=240 
> Tue Dec 22 10:47:13 2015 [14002]:  0x0  0x0  0x0  0x0  0x0  0xf0 g| 0x1  0x0  0x0  0x0  0x0  0x3  0x0  0x0  0x0  0x0  0x0  0x0  0x0 `=| 0x1  0x0  0x0  0x0  0x0  0xa  0x0  0x0  0xc8  0xaa  0x7f  0x0  0x0  h| 0x1  0x0  0x0  0x0  0x0  0x3  0x0  0x0  0x0  0x0  0x0  0x0  0x0 `=|
> Tue Dec 22 10:47:13 2015 [14002]: arg[9]: size=187 
> Tue Dec 22 10:47:13 2015 [14002]:  0x1  0x0  0x0  0x0  0x0   0x0  0x0  0x0 | 0x0  0x0  0x0  0xc   0x0  0x1  0x0  0x0  0x0  0x0 0 0xf4  0x1  0x0  0x0  0x0  0x0  0x0  0xa  0x0 ` 0x1  0x0  0x0  0x0  0x0  0x10  0x0  0x0 
> Tue Dec 22 10:47:13 2015 [14002]: arg[10]: size=121 
> Tue Dec 22 10:47:13 2015 [14002]:  0x0  0x0  0x1  0x0 @ 0x1  0x0  0x0  0x0  0x0 1 0x0  0x0  0x0 | 0x0  0x0  0x0  0x1  0x0 @ 0x1  0x0  0x0  0x0  0x0 . 0x0 
> Tue Dec 22 10:47:13 2015 [14002]: arg[11]: size=200 
> Tue Dec 22 10:47:13 2015 [14002]:  0x0  0x10  0x0  0x0  0x0 | 0x0  0x0  0x0  0xc  0x10  0x0  0x1  0x0  0x0  0x0  0x0 1 0x0  0x0  0x0 | 0x0  0x0  0x0  0x1  0x0 @ 0x1  0x0  0x0  0x0  0x0 0 0x0  0x0  0x0 | 0x0  0x0  0x0  0x1  0x0 @ 0x1 
> Tue Dec 22 10:47:13 2015 [14002]: arg[12]: size=71 
> Tue Dec 22 10:47:13 2015 [14002]:  0x0  0x1  0x0 @ 0x1  0x0  0x0  0x0  0x0 2 0x0  0x0  0x0 | 0x0  0x0 
> Tue Dec 22 10:47:13 2015 [14002]: arg[13]: size=224 
> Tue Dec 22 10:47:13 2015 [14002]:  0x0  0x0 1 0x0  0x0  0x0 | 0x0  0x0  0x0  0x1  0x0 @ 0x1  0x0  0x0  0x0  0x0 0 0x0  0x0  0x0 | 0x0  0x0  0x0  0x1  0x0 @ 0x1  0x0  0x0  0x0  0x0 . 0x0  0x0  0x0 | 0x0  0x0  0x0  0x1  0x0  0x0  0x1  0x0  0x0  0x0  0x0 1
> Tue Dec 22 10:47:13 2015 [14002]: arg[14]: size=50 
> Tue Dec 22 10:47:13 2015 [14002]:  0x0  0x0   0x0  0x0  0x0 | 0x0  0x0  0x0  0xc  
> Tue Dec 22 10:47:13 2015 [14002]: arg[15]: size=116 
> Tue Dec 22 10:47:13 2015 [14002]: 1 0x0  0x0  0x0 | 0x0  0x0  0x0  0x1  0x10 D 0x1  0x0  0x0  0x0  0x0 [ 0x0  0x0  0x0 | 0x0  0x0  0x0  0x2   0x4 
> Tue Dec 22 10:47:13 2015 [14002]: arg[16]: size=119 
> Tue Dec 22 10:47:13 2015 [14002]: | 0x0  0x0  0x0  0x2   0x4  0x0 n 0x0  0x0  0x0 1 0x0  0x0  0x0 | 0x0  0x0  0x0  0x1  0x10 D 0x1  0x0  0x0  0x0  0x0 [
> Tue Dec 22 10:47:13 2015 [14002]: arg[17]: size=111 
> Tue Dec 22 10:47:13 2015 [14002]:  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0 
> Tue Dec 22 10:47:13 2015 [14002]: arg[18]: size=37 
> Tue Dec 22 10:47:13 2015 [14002]:  0x0  0x0  0x0  0x0  0x0  0x0  0x0 
> Tue Dec 22 10:47:13 2015 [14002]: arg[19]: size=134 
> Tue Dec 22 10:47:13 2015 [14002]:  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0 
> Tue Dec 22 10:47:13 2015 [14002]: arg[20]: size=96 
> Tue Dec 22 10:47:13 2015 [14002]:  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0 
> Tue Dec 22 10:47:13 2015 [14002]: arg[21]: size=185 
> Tue Dec 22 10:47:13 2015 [14002]:  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0 
> Tue Dec 22 10:47:13 2015 [14002]: arg[22]: size=233 
> Tue Dec 22 10:47:13 2015 [14002]:  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0 
> Tue Dec 22 10:47:13 2015 [14002]: arg[23]: size=132 
> Tue Dec 22 10:47:13 2015 [14002]:  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0 
> Tue Dec 22 10:47:13 2015 [14002]: arg[24]: size=73 
> Tue Dec 22 10:47:13 2015 [14002]:  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0 
> Tue Dec 22 10:47:13 2015 [14002]: arg[25]: size=62 
> Tue Dec 22 10:47:13 2015 [14002]:  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0 
> Tue Dec 22 10:47:13 2015 [14002]: arg[26]: size=237 
> Tue Dec 22 10:47:13 2015 [14002]:  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0 
> Tue Dec 22 10:47:13 2015 [14002]: arg[27]: size=107 
> Tue Dec 22 10:47:13 2015 [14002]:  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0 
> Tue Dec 22 10:47:13 2015 [14002]: arg[28]: size=121 
> Tue Dec 22 10:47:13 2015 [14002]:  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0 
> Tue Dec 22 10:47:13 2015 [14002]: arg[29]: size=174 
> Tue Dec 22 10:47:13 2015 [14002]:  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0 
> Tue Dec 22 10:47:13 2015 [14002]: arg[30]: size=100 
> Tue Dec 22 10:47:13 2015 [14002]:  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0 
> Tue Dec 22 10:47:13 2015 [14002]: arg[31]: size=174 
> Tue Dec 22 10:47:13 2015 [14002]:  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0 
> Tue Dec 22 10:47:13 2015 [14002]: arg[32]: size=98 
> Tue Dec 22 10:47:13 2015 [14002]:  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0 
> Tue Dec 22 10:47:13 2015 [14002]: arg[33]: size=36 
> Tue Dec 22 10:47:13 2015 [14002]:  0x0  0x0  0x0  0x0  0x0  0x0  0x0 
> Tue Dec 22 10:47:13 2015 [14002]: arg[34]: size=198 
> Tue Dec 22 10:47:13 2015 [14002]:  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0 
> Tue Dec 22 10:47:13 2015 [14002]: arg[35]: size=106 
> Tue Dec 22 10:47:13 2015 [14002]:  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0 
> Tue Dec 22 10:47:13 2015 [14002]: arg[36]: size=31 
> Tue Dec 22 10:47:13 2015 [14002]:  0x0  0x0  0x0  0x0  0x0  0x0 
> Tue Dec 22 10:47:13 2015 [14002]: arg[37]: size=144 
> Tue Dec 22 10:47:13 2015 [14002]:  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0 
> Tue Dec 22 10:47:13 2015 [14002]: arg[38]: size=128 
> Tue Dec 22 10:47:13 2015 [14002]:  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0 
> Tue Dec 22 10:47:13 2015 [14002]: arg[39]: size=127 
> Tue Dec 22 10:47:13 2015 [14002]:  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0 
> Tue Dec 22 10:47:13 2015 [14002]: arg[40]: size=76 
> Tue Dec 22 10:47:13 2015 [14002]:  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0 
> Tue Dec 22 10:47:13 2015 [14002]: arg[41]: size=112 
> Tue Dec 22 10:47:13 2015 [14002]:  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0 
> Tue Dec 22 10:47:13 2015 [14002]: arg[42]: size=47 
> Tue Dec 22 10:47:13 2015 [14002]:  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0 
> Tue Dec 22 10:47:13 2015 [14002]: arg[43]: size=253 
> Tue Dec 22 10:47:13 2015 [14002]:  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0 
> Tue Dec 22 10:47:13 2015 [14002]: arg[44]: size=239 
> Tue Dec 22 10:47:13 2015 [14002]:  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0 
> Tue Dec 22 10:47:13 2015 [14002]: arg[45]: size=60 
> Tue Dec 22 10:47:13 2015 [14002]:  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0 
> Tue Dec 22 10:47:13 2015 [14002]: arg[46]: size=245 
> Tue Dec 22 10:47:13 2015 [14002]:  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0 
> Tue Dec 22 10:47:13 2015 [14002]: arg[47]: size=198 
> Tue Dec 22 10:47:13 2015 [14002]:  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0 
> Tue Dec 22 10:47:13 2015 [14002]: arg[48]: size=175 
> Tue Dec 22 10:47:13 2015 [14002]:  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0 
> Tue Dec 22 10:47:13 2015 [14002]: arg[49]: size=125 
> Tue Dec 22 10:47:13 2015 [14002]:  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0 
> Tue Dec 22 10:47:13 2015 [14002]: arg[50]: size=246 
> Tue Dec 22 10:47:13 2015 [14002]:  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0 
> Tue Dec 22 10:47:13 2015 [14002]: arg[51]: size=118 
> Tue Dec 22 10:47:13 2015 [14002]:  0x0  0x1  0x0 @ 0x1  0x0  0x0  0x0  0x0 0 0x0  0x0  0x0 | 0x0  0x0  0x0  0x1  0x0 @ 0x1  0x0  0x0  0x0  0x0 . 0x0 
> Tue Dec 22 10:47:13 2015 [14002]: arg[52]: size=150 
> Tue Dec 22 10:47:13 2015 [14002]:  0x0  0x0  0x0 5 0x0  0x0  0x0 | 0x0  0x0  0x0  0x1  0x0 @ 0x1  0x0  0x0  0x0  0x0 5 0x0  0x0  0x0 | 0x0  0x0  0x0  0x1  0x0 @ 0x1  0x0  0x0  0x0 
> Tue Dec 22 10:47:13 2015 [14002]: arg[53]: size=245 
> Tue Dec 22 10:47:13 2015 [14002]:  0x1  0x0  0x0  0x0  0x0  0x3  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0xd0  0x89 | 0x1  0x0  0x0  0x0  0x0  0xa  0x0  0x0  0xc8  0xaa  0x7f  0x0  0x0  0x10 }| 0x1  0x0  0x0  0x0  0x0  0x3  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0xd0  0x89 | 0x1  0x0 
> Tue Dec 22 10:47:13 2015 [14002]: arg[54]: size=209 
> Tue Dec 22 10:47:13 2015 [14002]:  0xc   0x0  0x1  0x0  0x0  0x0  0x0 P 0x90  0x1  0x0  0x0  0x0  0x0  0x0  0xa  0x0 ` 0x1  0x0  0x0  0x0  0x0  0x10  0x0  0x0  0x0 | 0x0  0x0  0x0  0xc  0x10  0x0  0x1  0x0  0x0  0x0  0x0 1 0x0  0x0  0x0 |
> Tue Dec 22 10:47:13 2015 [14002]: arg[55]: size=206 
> Tue Dec 22 10:47:13 2015 [14002]:  0x0  0x0  0x1  0x0  0x0  0x0  0x0 1 0x0  0x0  0x0 | 0x0  0x0  0x0  0x1  0x0 @ 0x1  0x0  0x0  0x0  0x0 4 0x0  0x0  0x0 | 0x0  0x0  0x0  0x1  0x0 @ 0x1  0x0  0x0  0x0  0x0 2 0x0  0x0  0x0 | 0x0  0x0  0x0 
> Tue Dec 22 10:47:13 2015 [14002]: arg[56]: size=96 
> Tue Dec 22 10:47:13 2015 [14002]:  0x0  0x10  0xc6  0xf1  0xc7  0xaa  0x7f  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0 
> Tue Dec 22 10:47:13 2015 [14002]: arg[57]: size=4 
> Tue Dec 22 10:47:13 2015 [14002]: 
> Tue Dec 22 10:47:13 2015 [14002]: arg[58]: size=193 
> Tue Dec 22 10:47:13 2015 [14002]:  0x1  0x0  0x0  0x0  0x0 x_| 0x1  0x0  0x0  0x0  0x0  0xc8 _| 0x1  0x0  0x0  0x0  0x0  0xf8 [| 0x1  0x0  0x0  0x0  0x0 H`| 0x1  0x0  0x0  0x0  0x0  0x80  0xe ' 0xc8  0xaa  0x7f  0x0  0x0 
> Tue Dec 22 10:47:13 2015 [14002]: arg[59]: size=111 
> Tue Dec 22 10:47:13 2015 [14002]:  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0xc8 `|
> Tue Dec 22 10:47:13 2015 [14002]: arg[60]: size=143 
> Tue Dec 22 10:47:13 2015 [14002]:  0xc7  0xaa  0x7f  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x88 a| 0x1  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0 
> Tue Dec 22 10:47:13 2015 [14002]: arg[61]: size=51 
> Tue Dec 22 10:47:13 2015 [14002]:  0x0  0x0  0x0  0x0  0x0  0x0  0x16  0x0  0x0 
> Tue Dec 22 10:47:13 2015 [14002]: arg[62]: size=167 
> Tue Dec 22 10:47:13 2015 [14002]:  0x0  0x0  0x0 ^10\.175\.255\.([4-7])$ 0x0 Q 0x0  0x0  0x0  0x0  0x0  0x0  0x0  z| 0x1  0x0  0x0  0x0  0x0  0xe0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0xe0  0x0  0x0 
> Tue Dec 22 10:47:13 2015 [14002]: arg[63]: size=239 
> Tue Dec 22 10:47:13 2015 [14002]:  0x0  0x0  0x0  0x0 ! 0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x1  0x0  0x0  0x0  0xaa  0x7f  0x0  0x0  0xd8  0xe ' 0xc8  0xaa  0x7f  0x0  0x0  0xe  0x0  0x0  0x0  0x0  0x0  0x0  0x0 ! 0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x2  0x0  0x0  0x0 
> Tue Dec 22 10:47:13 2015 [14002]: arg[64]: size=134 
> Tue Dec 22 10:47:13 2015 [14002]:  0x0  0x0  0x0  0xff  0x3  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0 
> Tue Dec 22 10:47:13 2015 [14002]: arg[65]: size=229 
> Tue Dec 22 10:47:13 2015 [14002]:  0x1  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0 
> Tue Dec 22 10:47:13 2015 [14002]: arg[66]: size=99 
> Tue Dec 22 10:47:13 2015 [14002]:  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0 
> Tue Dec 22 10:47:13 2015 [14002]: arg[67]: size=38 
> Tue Dec 22 10:47:13 2015 [14002]:  0xbd | 0x1  0x0  0x0  0x0  0x0  0x0 
> Tue Dec 22 10:47:13 2015 [14002]: arg[68]: size=96 
> Tue Dec 22 10:47:13 2015 [14002]:  0x0  0xe0  0xca | 0x1  0x0  0x0  0x0  0x0  0x10  0xcc | 0x1  0x0  0x0  0x0  0x0  0x0  0x0 
> Tue Dec 22 10:47:13 2015 [14002]: arg[69]: size=139 
> Tue Dec 22 10:47:13 2015 [14002]:  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0xfc  0xb2  0x3  0x0  0x0  0x0  0x0  0x0  0x0  0x0 
> Tue Dec 22 10:47:13 2015 [14002]: arg[70]: size=241 
> Tue Dec 22 10:47:13 2015 [14002]:  0x0  0x0  0xff  0xff  0xff  0xff  0xff  0xff  0xff  0xff  0xff  0xff  0xff  0xff  0x19  0x0  0x0  0x0  0x1a  0x0  0x0  0x0  0x1b  0x0  0x0  0x0  0x1c  0x0  0x0  0x0  0x1d  0x0  0x0  0x0  0x1e  0x0  0x0  0x0  0x1f  0x0  0x0  0x0   0x0  0x0 
> Tue Dec 22 10:47:13 2015 [14002]: arg[71]: size=98 
> Tue Dec 22 10:47:13 2015 [14002]:  0x0  0x0  0x0  0x0  0x0  0xa8 g| 0x1  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0 
> Tue Dec 22 10:47:13 2015 [14002]: arg[72]: size=19 
> Tue Dec 22 10:47:13 2015 [14002]:  0x0  0x0  0x0 
> Tue Dec 22 10:47:13 2015 [14002]: arg[73]: size=150 
> Tue Dec 22 10:47:13 2015 [14002]:  0x10  0xe # 0xc8  0xaa  0x7f  0x0  0x0 0 0x0  0x0  0x0  0x0  0x0  0x0  0x0 1 0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0xff 
> Tue Dec 22 10:47:13 2015 [14002]: arg[74]: size=94 
> Tue Dec 22 10:47:13 2015 [14002]:  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0 
> Tue Dec 22 10:47:13 2015 [14002]: arg[75]: size=88 
> Tue Dec 22 10:47:13 2015 [14002]:  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0 
> Tue Dec 22 10:47:13 2015 [14002]: arg[76]: size=9 
> Tue Dec 22 10:47:13 2015 [14002]:  0x0 
> Tue Dec 22 10:47:13 2015 [14002]: arg[77]: size=161 
> Tue Dec 22 10:47:13 2015 [14002]:  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0 
> Tue Dec 22 10:47:13 2015 [14002]: arg[78]: size=132 
> Tue Dec 22 10:47:13 2015 [14002]:  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0 
> Tue Dec 22 10:47:13 2015 [14002]: arg[79]: size=0 
> Tue Dec 22 10:47:13 2015 [14002]: arg[80]: size=0 
> Tue Dec 22 10:47:13 2015 [14002]: arg[81]: size=0 
> Tue Dec 22 10:47:13 2015 [14002]: arg[82]: size=0 
> Tue Dec 22 10:47:13 2015 [14002]: arg[83]: size=209 
> Tue Dec 22 10:47:13 2015 [14002]:  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0 
> Tue Dec 22 10:47:13 2015 [14002]: arg[84]: size=1 
> Tue Dec 22 10:47:13 2015 [14002]: 
> Tue Dec 22 10:47:13 2015 [14002]: arg[85]: size=0 
> Tue Dec 22 10:47:13 2015 [14002]: arg[86]: size=0 
> Tue Dec 22 10:47:13 2015 [14002]: arg[87]: size=0 
> Tue Dec 22 10:47:13 2015 [14002]: arg[88]: size=0 
> Tue Dec 22 10:47:13 2015 [14002]: End packet
> Tue Dec 22 10:47:13 2015 [14002]: Error 12.12.151.142: acct minimum payload: 98, got: 88

> Tue Dec 22 10:47:22 2015 [14004]: Read ACCT size=104
> Tue Dec 22 10:47:22 2015 [14004]: validation request from 12.12.151.142
> Tue Dec 22 10:47:22 2015 [14004]: PACKET: key=cnshtetacauthstr
> Tue Dec 22 10:47:22 2015 [14004]: version 192 (0xc0), type 3, seq no 1, flags 0x0
> Tue Dec 22 10:47:22 2015 [14004]: session_id 2028098991 (0x78e255af), Data length 92 (0x5c)
> Tue Dec 22 10:47:22 2015 [14004]: End header
> Tue Dec 22 10:47:22 2015 [14004]: ACCT, flags=0xc6 method=208 priv_lvl=65
> Tue Dec 22 10:47:22 2015 [14004]: type=8 svc=27
> Tue Dec 22 10:47:22 2015 [14004]: user_len=180 port_len=2 rem_addr_len=108
> Tue Dec 22 10:47:22 2015 [14004]: arg_cnt=27
> Tue Dec 22 10:47:22 2015 [14004]: User: 
> Tue Dec 22 10:47:22 2015 [14004]: VG! 0xdd  0xc2  0x12  0xac  0xf8 @ 0xc7 ) 0xad  0xe2 B 0xd  0x95  0x9f  0x99 dY 0xb0 %t# 0xe1  0xaf  0xf9  0xc  0xa1 4 0xd5  0x88 bN 0x8  0x8a  0xab ^ 0xd4  0x94  0xff  0x14 
> Tue Dec 22 10:47:22 2015 [14004]: port: 
> Tue Dec 22 10:47:22 2015 [14004]: 
> Tue Dec 22 10:47:22 2015 [14004]: rem_addr: 
> Tue Dec 22 10:47:22 2015 [14004]:  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0 
> Tue Dec 22 10:47:22 2015 [14004]: arg[0]: size=98 

the size of arg0 exceeds the data length by itself.


> Tue Dec 22 10:47:27 2015 [14005]: session_id 3516540846 (0xd19a27ae), Data length 92 (0x5c)
> Tue Dec 22 10:47:27 2015 [14005]: End header
> Tue Dec 22 10:47:27 2015 [14005]: ACCT, flags=0xc6 method=6 priv_lvl=181
> Tue Dec 22 10:47:27 2015 [14005]: type=125 svc=97
> Tue Dec 22 10:47:27 2015 [14005]: user_len=177 port_len=91 rem_addr_len=25
> Tue Dec 22 10:47:27 2015 [14005]: arg_cnt=105

again, argument length bytes exceed the data length.

nothing tacacs can do about that; garbage in - garbage out.

From wallance.hou at ericsson.com  Wed Dec 30 07:24:40 2015
From: wallance.hou at ericsson.com (Wallance Hou)
Date: Wed, 30 Dec 2015 07:24:40 +0000
Subject: [tac_plus] Regarding of an issue on tac_plus
In-Reply-To: <20151230011602.GK60026@shrubbery.net>
References: <ED708375D7971545B71B0BDFFF0DC4DB3DA376CE@ESGSCMB101.ericsson.se>
 <20151217213738.GH98068@shrubbery.net>
 <ED708375D7971545B71B0BDFFF0DC4DB3DA37A9A@ESGSCMB101.ericsson.se>
 <20151221223826.GK26865@shrubbery.net>
 <ED708375D7971545B71B0BDFFF0DC4DB3DA389AC@ESGSCMB101.ericsson.se>
 <20151230011602.GK60026@shrubbery.net>
Message-ID: <ED708375D7971545B71B0BDFFF0DC4DB3DA3D78A@ESGSCMB101.ericsson.se>

Hi,

Thanks very much for your kind analysis and appreciate that. I will ask vendor for this support. BTW, I guess it is very possible to need an upgrade for JunOS and ExtremeOS as at least Junipe EX series switch does not have this kind of issue. 

Thanks.
Wallance Hou
ITTE Infrastructure Ops
wallance.hou at ericsson.com
Phone: 887 29303


-----Original Message-----
From: heasley [mailto:heas at shrubbery.net] 
Sent: Wednesday, December 30, 2015 9:16 AM
To: Wallance Hou
Cc: heasley; tac_plus at shrubbery.net
Subject: Re: [tac_plus] Regarding of an issue on tac_plus

Tue, Dec 22, 2015 at 03:04:16AM +0000, Wallance Hou:
> Tue Dec 22 10:47:13 2015 [14002]: connect from 12.12.151.142 
> [12.12.151.142] Tue Dec 22 10:47:13 2015 [14002]: Read ACCT size=100 
> Tue Dec 22 10:47:13 2015 [14002]: validation request from 
> 12.12.151.142 Tue Dec 22 10:47:13 2015 [14002]: version 192 (0xc0), 
> type 3, seq no 1, flags 0x0 Tue Dec 22 10:47:13 2015 [14002]: 
> session_id 4028064090 (0xf017615a), Data length 88 (0x58)

The data length of the ACCT packet, not including the 12 byte header, is
88 bytes.  it read 100 bytes.

> Tue Dec 22 10:47:13 2015 [14002]: End header Tue Dec 22 10:47:13 2015 
> [14002]: ACCT, flags=0xfd method=90 priv_lvl=251 Tue Dec 22 10:47:13 
> 2015 [14002]: type=82 svc=118 Tue Dec 22 10:47:13 2015 [14002]: 
> user_len=146 port_len=44 rem_addr_len=76 Tue Dec 22 10:47:13 2015 
> [14002]: arg_cnt=89

89 arguments; with one byte for each argument's length, that already exceeds the length of the data portion of the packet.  It is probably using uninitialized memory when creating the packet.  You can report that to the vendor.

> Tue Dec 22 10:47:13 2015 [14002]: User: 
> Tue Dec 22 10:47:13 2015 [14002]:  0x0  0x0  0x98  0x10 ' 0xc8  0xaa  0x7f  0x0  0x0  0x98  0x10 ' 0xc8  0xaa  0x7f  0x0  0x0   0x0  0x0  0x0  0x0  0x0  0x0  0x0 0 0x0  0x0  0x0 
> Tue Dec 22 10:47:13 2015 [14002]: port: 
> Tue Dec 22 10:47:13 2015 [14002]:  0x0  0x0  0x0  0x0  0x0  0x0  0x0  
> 0x0 Tue Dec 22 10:47:13 2015 [14002]: rem_addr:
> Tue Dec 22 10:47:13 2015 [14002]:  0x0  0x0  0x0  0x0  0x0  0x0  0x0  
> 0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0 Tue Dec 22 10:47:13 2015 
> [14002]: arg[0]: size=199 Tue Dec 22 10:47:13 2015 [14002]:  0x0  0x0  
> 0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  
> 0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  
> 0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0 Tue Dec 22 10:47:13 2015 
> [14002]: arg[1]: size=27 Tue Dec 22 10:47:13 2015 [14002]:  0x0 acl_cnshte 0x0  0xc8 Tue Dec 22 10:47:13 2015 [14002]: arg[2]: size=3 Tue Dec 22 10:47:13 2015 [14002]:
> Tue Dec 22 10:47:13 2015 [14002]: arg[3]: size=120 Tue Dec 22 10:47:13 
> 2015 [14002]:  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x3  0x0  
> 0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0 Tue Dec 22 
> 10:47:13 2015 [14002]: arg[4]: size=75 Tue Dec 22 10:47:13 2015 
> [14002]:  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  
> 0x0  0x0 Tue Dec 22 10:47:13 2015 [14002]: arg[5]: size=194 Tue Dec 22 
> 10:47:13 2015 [14002]:  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  
> 0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  
> 0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  
> 0x0 Tue Dec 22 10:47:13 2015 [14002]: arg[6]: size=239 Tue Dec 22 
> 10:47:13 2015 [14002]: | 0x1  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  
> 0x0  0x0  0x0  0x0  0xe0 K| 0x1  0x0  0x0  0x0  0x0  0x80  0xaa | 0x1  
> 0x0  0x0  0x0  0x0  0xc0  0xab | 0x1  0x0  0x0  0x0  0x0  0x0  0xad | 0x1  0x0  0x0  0x0  0x0 ` 0xae | 0x1  0x0  0x0 Tue Dec 22 10:47:13 2015 [14002]: arg[7]: size=234 Tue Dec 22 10:47:13 2015 [14002]:  0x0  0x0  0x0 | 0x0  0x0  0x0  0x1  0x0  0x0  0x1  0x0  0x0  0x0  0x0 1 0x0  0x0  0x0 | 0x0  0x0  0x0  0x1  0x0 @ 0x1  0x0  0x0  0x0  0x0 7 0x0  0x0  0x0 | 0x0  0x0  0x0  0x1  0x0 @ 0x1  0x0  0x0  0x0  0x0 5 0x0  0x0  0x0 | 0x0 Tue Dec 22 10:47:13 2015 [14002]: arg[8]: size=240 Tue Dec 22 10:47:13 2015 [14002]:  0x0  0x0  0x0  0x0  0x0  0xf0 g| 0x1  0x0  0x0  0x0  0x0  0x3  0x0  0x0  0x0  0x0  0x0  0x0  0x0 `=| 0x1  0x0  0x0  0x0  0x0  0xa  0x0  0x0  0xc8  0xaa  0x7f  0x0  0x0  h| 0x1  0x0  0x0  0x0  0x0  0x3  0x0  0x0  0x0  0x0  0x0  0x0  0x0 `=| Tue Dec 22 10:47:13 2015 [14002]: arg[9]: size=187
> Tue Dec 22 10:47:13 2015 [14002]:  0x1  0x0  0x0  0x0  0x0   0x0  0x0  0x0 | 0x0  0x0  0x0  0xc   0x0  0x1  0x0  0x0  0x0  0x0 0 0xf4  0x1  0x0  0x0  0x0  0x0  0x0  0xa  0x0 ` 0x1  0x0  0x0  0x0  0x0  0x10  0x0  0x0 
> Tue Dec 22 10:47:13 2015 [14002]: arg[10]: size=121 Tue Dec 22 
> 10:47:13 2015 [14002]:  0x0  0x0  0x1  0x0 @ 0x1  0x0  0x0  0x0  0x0 1 
> 0x0  0x0  0x0 | 0x0  0x0  0x0  0x1  0x0 @ 0x1  0x0  0x0  0x0  0x0 . 
> 0x0 Tue Dec 22 10:47:13 2015 [14002]: arg[11]: size=200 Tue Dec 22 
> 10:47:13 2015 [14002]:  0x0  0x10  0x0  0x0  0x0 | 0x0  0x0  0x0  0xc  
> 0x10  0x0  0x1  0x0  0x0  0x0  0x0 1 0x0  0x0  0x0 | 0x0  0x0  0x0  
> 0x1  0x0 @ 0x1  0x0  0x0  0x0  0x0 0 0x0  0x0  0x0 | 0x0  0x0  0x0  
> 0x1  0x0 @ 0x1 Tue Dec 22 10:47:13 2015 [14002]: arg[12]: size=71 Tue 
> Dec 22 10:47:13 2015 [14002]:  0x0  0x1  0x0 @ 0x1  0x0  0x0  0x0  0x0 2 0x0  0x0  0x0 | 0x0  0x0 Tue Dec 22 10:47:13 2015 [14002]: arg[13]: size=224 Tue Dec 22 10:47:13 2015 [14002]:  0x0  0x0 1 0x0  0x0  0x0 | 0x0  0x0  0x0  0x1  0x0 @ 0x1  0x0  0x0  0x0  0x0 0 0x0  0x0  0x0 | 0x0  0x0  0x0  0x1  0x0 @ 0x1  0x0  0x0  0x0  0x0 . 0x0  0x0  0x0 | 0x0  0x0  0x0  0x1  0x0  0x0  0x1  0x0  0x0  0x0  0x0 1 Tue Dec 22 10:47:13 2015 [14002]: arg[14]: size=50
> Tue Dec 22 10:47:13 2015 [14002]:  0x0  0x0   0x0  0x0  0x0 | 0x0  0x0  0x0  0xc  
> Tue Dec 22 10:47:13 2015 [14002]: arg[15]: size=116 
> Tue Dec 22 10:47:13 2015 [14002]: 1 0x0  0x0  0x0 | 0x0  0x0  0x0  0x1  0x10 D 0x1  0x0  0x0  0x0  0x0 [ 0x0  0x0  0x0 | 0x0  0x0  0x0  0x2   0x4 
> Tue Dec 22 10:47:13 2015 [14002]: arg[16]: size=119 
> Tue Dec 22 10:47:13 2015 [14002]: | 0x0  0x0  0x0  0x2   0x4  0x0 n 0x0  0x0  0x0 1 0x0  0x0  0x0 | 0x0  0x0  0x0  0x1  0x10 D 0x1  0x0  0x0  0x0  0x0 [
> Tue Dec 22 10:47:13 2015 [14002]: arg[17]: size=111 Tue Dec 22 
> 10:47:13 2015 [14002]:  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  
> 0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0 Tue 
> Dec 22 10:47:13 2015 [14002]: arg[18]: size=37 Tue Dec 22 10:47:13 
> 2015 [14002]:  0x0  0x0  0x0  0x0  0x0  0x0  0x0 Tue Dec 22 10:47:13 
> 2015 [14002]: arg[19]: size=134 Tue Dec 22 10:47:13 2015 [14002]:  0x0  
> 0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  
> 0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0 Tue Dec 22 
> 10:47:13 2015 [14002]: arg[20]: size=96 Tue Dec 22 10:47:13 2015 
> [14002]:  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  
> 0x0  0x0  0x0  0x0  0x0  0x0  0x0 Tue Dec 22 10:47:13 2015 [14002]: 
> arg[21]: size=185 Tue Dec 22 10:47:13 2015 [14002]:  0x0  0x0  0x0  
> 0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  
> 0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  
> 0x0  0x0  0x0  0x0  0x0 Tue Dec 22 10:47:13 2015 [14002]: arg[22]: 
> size=233 Tue Dec 22 10:47:13 2015 [14002]:  0x0  0x0  0x0  0x0  0x0  
> 0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  
> 0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  
> 0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0 Tue 
> Dec 22 10:47:13 2015 [14002]: arg[23]: size=132 Tue Dec 22 10:47:13 
> 2015 [14002]:  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  
> 0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  
> 0x0 Tue Dec 22 10:47:13 2015 [14002]: arg[24]: size=73 Tue Dec 22 
> 10:47:13 2015 [14002]:  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  
> 0x0  0x0  0x0  0x0  0x0 Tue Dec 22 10:47:13 2015 [14002]: arg[25]: 
> size=62 Tue Dec 22 10:47:13 2015 [14002]:  0x0  0x0  0x0  0x0  0x0  
> 0x0  0x0  0x0  0x0  0x0  0x0  0x0 Tue Dec 22 10:47:13 2015 [14002]: 
> arg[26]: size=237 Tue Dec 22 10:47:13 2015 [14002]:  0x0  0x0  0x0  
> 0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  
> 0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  
> 0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  
> 0x0  0x0 Tue Dec 22 10:47:13 2015 [14002]: arg[27]: size=107 Tue Dec 
> 22 10:47:13 2015 [14002]:  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  
> 0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0 Tue Dec 22 
> 10:47:13 2015 [14002]: arg[28]: size=121 Tue Dec 22 10:47:13 2015 
> [14002]:  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  
> 0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0 Tue Dec 22 
> 10:47:13 2015 [14002]: arg[29]: size=174 Tue Dec 22 10:47:13 2015 
> [14002]:  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  
> 0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  
> 0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0 Tue Dec 22 10:47:13 2015 
> [14002]: arg[30]: size=100 Tue Dec 22 10:47:13 2015 [14002]:  0x0  0x0  
> 0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  
> 0x0  0x0  0x0 Tue Dec 22 10:47:13 2015 [14002]: arg[31]: size=174 Tue 
> Dec 22 10:47:13 2015 [14002]:  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  
> 0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  
> 0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0 Tue Dec 22 
> 10:47:13 2015 [14002]: arg[32]: size=98 Tue Dec 22 10:47:13 2015 
> [14002]:  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  
> 0x0  0x0  0x0  0x0  0x0  0x0  0x0 Tue Dec 22 10:47:13 2015 [14002]: 
> arg[33]: size=36 Tue Dec 22 10:47:13 2015 [14002]:  0x0  0x0  0x0  0x0  
> 0x0  0x0  0x0 Tue Dec 22 10:47:13 2015 [14002]: arg[34]: size=198 Tue 
> Dec 22 10:47:13 2015 [14002]:  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  
> 0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  
> 0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  
> 0x0  0x0  0x0 Tue Dec 22 10:47:13 2015 [14002]: arg[35]: size=106 Tue 
> Dec 22 10:47:13 2015 [14002]:  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  
> 0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0 Tue 
> Dec 22 10:47:13 2015 [14002]: arg[36]: size=31 Tue Dec 22 10:47:13 
> 2015 [14002]:  0x0  0x0  0x0  0x0  0x0  0x0 Tue Dec 22 10:47:13 2015 
> [14002]: arg[37]: size=144 Tue Dec 22 10:47:13 2015 [14002]:  0x0  0x0  
> 0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  
> 0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0 Tue Dec 22 
> 10:47:13 2015 [14002]: arg[38]: size=128 Tue Dec 22 10:47:13 2015 
> [14002]:  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  
> 0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0 Tue 
> Dec 22 10:47:13 2015 [14002]: arg[39]: size=127 Tue Dec 22 10:47:13 
> 2015 [14002]:  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  
> 0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0 
> Tue Dec 22 10:47:13 2015 [14002]: arg[40]: size=76 Tue Dec 22 10:47:13 
> 2015 [14002]:  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  
> 0x0  0x0  0x0  0x0 Tue Dec 22 10:47:13 2015 [14002]: arg[41]: size=112 
> Tue Dec 22 10:47:13 2015 [14002]:  0x0  0x0  0x0  0x0  0x0  0x0  0x0  
> 0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  
> 0x0 Tue Dec 22 10:47:13 2015 [14002]: arg[42]: size=47 Tue Dec 22 10:47:13 2015 [14002]:  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0 Tue Dec 22 10:47:13 2015 [14002]: arg[43]: size=253 Tue Dec 22 10:47:13 2015 [14002]:  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0 Tue Dec 22 10:47:13 2015 [14002]: arg[44]: size=239 Tue Dec 22 10:47:13 2015 [14002]:  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0 Tue Dec 22 10:47:13 2015 [14002]: arg[45]: size=60 Tue Dec 22 10:47:13 2015 [14002]:  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0 Tue Dec 22 10:47:13 2015 [14002]: arg[46]: size=245 Tue Dec 22 10:47:13 2015 [14002]:  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0 Tue Dec 22 10:47:13 2015 [14002]: arg[47]: size=198 Tue Dec 22 10:47:13 2015 [14002]:  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0 Tue Dec 22 10:47:13 2015 [14002]: arg[48]: size=175 Tue Dec 22 10:47:13 2015 [14002]:  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0 Tue Dec 22 10:47:13 2015 [14002]: arg[49]: size=125 Tue Dec 22 10:47:13 2015 [14002]:  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0 Tue Dec 22 10:47:13 2015 [14002]: arg[50]: size=246 Tue Dec 22 10:47:13 2015 [14002]:  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0 Tue Dec 22 10:47:13 2015 [14002]: arg[51]: size=118 Tue Dec 22 10:47:13 2015 [14002]:  0x0  0x1  0x0 @ 0x1  0x0  0x0  0x0  0x0 0 0x0  0x0  0x0 | 0x0  0x0  0x0  0x1  0x0 @ 0x1  0x0  0x0  0x0  0x0 . 0x0 Tue Dec 22 10:47:13 2015 [14002]: arg[52]: size=150 Tue Dec 22 10:47:13 2015 [14002]:  0x0  0x0  0x0 5 0x0  0x0  0x0 | 0x0  0x0  0x0  0x1  0x0 @ 0x1  0x0  0x0  0x0  0x0 5 0x0  0x0  0x0 | 0x0  0x0  0x0  0x1  0x0 @ 0x1  0x0  0x0  0x0 Tue Dec 22 10:47:13 2015 [14002]: arg[53]: size=245 Tue Dec 22 10:47:13 2015 [14002]:  0x1  0x0  0x0  0x0  0x0  0x3  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0xd0  0x89 | 0x1  0x0  0x0  0x0  0x0  0xa  0x0  0x0  0xc8  0xaa  0x7f  0x0  0x0  0x10 }| 0x1  0x0  0x0  0x0  0x0  0x3  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0xd0  0x89 | 0x1  0x0 Tue Dec 22 10:47:13 2015 [14002]: arg[54]: size=209
> Tue Dec 22 10:47:13 2015 [14002]:  0xc   0x0  0x1  0x0  0x0  0x0  0x0 P 0x90  0x1  0x0  0x0  0x0  0x0  0x0  0xa  0x0 ` 0x1  0x0  0x0  0x0  0x0  0x10  0x0  0x0  0x0 | 0x0  0x0  0x0  0xc  0x10  0x0  0x1  0x0  0x0  0x0  0x0 1 0x0  0x0  0x0 |
> Tue Dec 22 10:47:13 2015 [14002]: arg[55]: size=206 Tue Dec 22 
> 10:47:13 2015 [14002]:  0x0  0x0  0x1  0x0  0x0  0x0  0x0 1 0x0  0x0  
> 0x0 | 0x0  0x0  0x0  0x1  0x0 @ 0x1  0x0  0x0  0x0  0x0 4 0x0  0x0  
> 0x0 | 0x0  0x0  0x0  0x1  0x0 @ 0x1  0x0  0x0  0x0  0x0 2 0x0  0x0  
> 0x0 | 0x0  0x0  0x0 Tue Dec 22 10:47:13 2015 [14002]: arg[56]: size=96 
> Tue Dec 22 10:47:13 2015 [14002]:  0x0  0x10  0xc6  0xf1  0xc7  0xaa  0x7f  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0 Tue Dec 22 10:47:13 2015 [14002]: arg[57]: size=4 Tue Dec 22 10:47:13 2015 [14002]:
> Tue Dec 22 10:47:13 2015 [14002]: arg[58]: size=193 Tue Dec 22 
> 10:47:13 2015 [14002]:  0x1  0x0  0x0  0x0  0x0 x_| 0x1  0x0  0x0  0x0  
> 0x0  0xc8 _| 0x1  0x0  0x0  0x0  0x0  0xf8 [| 0x1  0x0  0x0  0x0  0x0 
> H`| 0x1  0x0  0x0  0x0  0x0  0x80  0xe ' 0xc8  0xaa  0x7f  0x0  0x0 
> Tue Dec 22 10:47:13 2015 [14002]: arg[59]: size=111 Tue Dec 22 
> 10:47:13 2015 [14002]:  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  
> 0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0xc8 `| Tue Dec 
> 22 10:47:13 2015 [14002]: arg[60]: size=143 Tue Dec 22 10:47:13 2015 
> [14002]:  0xc7  0xaa  0x7f  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  
> 0x0  0x0  0x88 a| 0x1  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  
> 0x0  0x0  0x0 Tue Dec 22 10:47:13 2015 [14002]: arg[61]: size=51 Tue 
> Dec 22 10:47:13 2015 [14002]:  0x0  0x0  0x0  0x0  0x0  0x0  0x16  0x0  
> 0x0 Tue Dec 22 10:47:13 2015 [14002]: arg[62]: size=167 Tue Dec 22 
> 10:47:13 2015 [14002]:  0x0  0x0  0x0 ^10\.175\.255\.([4-7])$ 0x0 Q 
> 0x0  0x0  0x0  0x0  0x0  0x0  0x0  z| 0x1  0x0  0x0  0x0  0x0  0xe0  
> 0x0  0x0  0x0  0x0  0x0  0x0  0x0  0xe0  0x0  0x0 Tue Dec 22 10:47:13 
> 2015 [14002]: arg[63]: size=239 Tue Dec 22 10:47:13 2015 [14002]:  0x0  
> 0x0  0x0  0x0 ! 0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x1  0x0  0x0  0x0  
> 0xaa  0x7f  0x0  0x0  0xd8  0xe ' 0xc8  0xaa  0x7f  0x0  0x0  0xe  0x0  
> 0x0  0x0  0x0  0x0  0x0  0x0 ! 0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x2  
> 0x0  0x0  0x0 Tue Dec 22 10:47:13 2015 [14002]: arg[64]: size=134 Tue 
> Dec 22 10:47:13 2015 [14002]:  0x0  0x0  0x0  0xff  0x3  0x0  0x0  0x0  
> 0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  
> 0x0  0x0  0x0  0x0 Tue Dec 22 10:47:13 2015 [14002]: arg[65]: size=229 
> Tue Dec 22 10:47:13 2015 [14002]:  0x1  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0 Tue Dec 22 10:47:13 2015 [14002]: arg[66]: size=99 Tue Dec 22 10:47:13 2015 [14002]:  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0 Tue Dec 22 10:47:13 2015 [14002]: arg[67]: size=38 Tue Dec 22 10:47:13 2015 [14002]:  0xbd | 0x1  0x0  0x0  0x0  0x0  0x0 Tue Dec 22 10:47:13 2015 [14002]: arg[68]: size=96 Tue Dec 22 10:47:13 2015 [14002]:  0x0  0xe0  0xca | 0x1  0x0  0x0  0x0  0x0  0x10  0xcc | 0x1  0x0  0x0  0x0  0x0  0x0  0x0 Tue Dec 22 10:47:13 2015 [14002]: arg[69]: size=139 Tue Dec 22 10:47:13 2015 [14002]:  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0xfc  0xb2  0x3  0x0  0x0  0x0  0x0  0x0  0x0  0x0 Tue Dec 22 10:47:13 2015 [14002]: arg[70]: size=241
> Tue Dec 22 10:47:13 2015 [14002]:  0x0  0x0  0xff  0xff  0xff  0xff  0xff  0xff  0xff  0xff  0xff  0xff  0xff  0xff  0x19  0x0  0x0  0x0  0x1a  0x0  0x0  0x0  0x1b  0x0  0x0  0x0  0x1c  0x0  0x0  0x0  0x1d  0x0  0x0  0x0  0x1e  0x0  0x0  0x0  0x1f  0x0  0x0  0x0   0x0  0x0 
> Tue Dec 22 10:47:13 2015 [14002]: arg[71]: size=98 Tue Dec 22 10:47:13 
> 2015 [14002]:  0x0  0x0  0x0  0x0  0x0  0xa8 g| 0x1  0x0  0x0  0x0  
> 0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0 Tue Dec 22 10:47:13 2015 
> [14002]: arg[72]: size=19 Tue Dec 22 10:47:13 2015 [14002]:  0x0  0x0  
> 0x0 Tue Dec 22 10:47:13 2015 [14002]: arg[73]: size=150 Tue Dec 22 
> 10:47:13 2015 [14002]:  0x10  0xe # 0xc8  0xaa  0x7f  0x0  0x0 0 0x0  
> 0x0  0x0  0x0  0x0  0x0  0x0 1 0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  
> 0x0  0x0  0x0  0x0  0x0  0xff Tue Dec 22 10:47:13 2015 [14002]: 
> arg[74]: size=94 Tue Dec 22 10:47:13 2015 [14002]:  0x0  0x0  0x0  0x0  
> 0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0 
> Tue Dec 22 10:47:13 2015 [14002]: arg[75]: size=88 Tue Dec 22 10:47:13 
> 2015 [14002]:  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  
> 0x0  0x0  0x0  0x0  0x0  0x0 Tue Dec 22 10:47:13 2015 [14002]: 
> arg[76]: size=9 Tue Dec 22 10:47:13 2015 [14002]:  0x0 Tue Dec 22 
> 10:47:13 2015 [14002]: arg[77]: size=161 Tue Dec 22 10:47:13 2015 
> [14002]:  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  
> 0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  
> 0x0  0x0  0x0  0x0  0x0  0x0 Tue Dec 22 10:47:13 2015 [14002]: 
> arg[78]: size=132 Tue Dec 22 10:47:13 2015 [14002]:  0x0  0x0  0x0  
> 0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  
> 0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0 Tue Dec 22 10:47:13 2015 
> [14002]: arg[79]: size=0 Tue Dec 22 10:47:13 2015 [14002]: arg[80]: 
> size=0 Tue Dec 22 10:47:13 2015 [14002]: arg[81]: size=0 Tue Dec 22 
> 10:47:13 2015 [14002]: arg[82]: size=0 Tue Dec 22 10:47:13 2015 [14002]: arg[83]: size=209 Tue Dec 22 10:47:13 2015 [14002]:  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0 Tue Dec 22 10:47:13 2015 [14002]: arg[84]: size=1 Tue Dec 22 10:47:13 2015 [14002]:
> Tue Dec 22 10:47:13 2015 [14002]: arg[85]: size=0 Tue Dec 22 10:47:13 
> 2015 [14002]: arg[86]: size=0 Tue Dec 22 10:47:13 2015 [14002]: 
> arg[87]: size=0 Tue Dec 22 10:47:13 2015 [14002]: arg[88]: size=0 Tue 
> Dec 22 10:47:13 2015 [14002]: End packet Tue Dec 22 10:47:13 2015 
> [14002]: Error 12.12.151.142: acct minimum payload: 98, got: 88

> Tue Dec 22 10:47:22 2015 [14004]: Read ACCT size=104 Tue Dec 22 
> 10:47:22 2015 [14004]: validation request from 12.12.151.142 Tue Dec 
> 22 10:47:22 2015 [14004]: PACKET: key=cnshtetacauthstr Tue Dec 22 
> 10:47:22 2015 [14004]: version 192 (0xc0), type 3, seq no 1, flags 0x0 
> Tue Dec 22 10:47:22 2015 [14004]: session_id 2028098991 (0x78e255af), 
> Data length 92 (0x5c) Tue Dec 22 10:47:22 2015 [14004]: End header Tue 
> Dec 22 10:47:22 2015 [14004]: ACCT, flags=0xc6 method=208 priv_lvl=65 
> Tue Dec 22 10:47:22 2015 [14004]: type=8 svc=27 Tue Dec 22 10:47:22 
> 2015 [14004]: user_len=180 port_len=2 rem_addr_len=108 Tue Dec 22 
> 10:47:22 2015 [14004]: arg_cnt=27 Tue Dec 22 10:47:22 2015 [14004]: 
> User:
> Tue Dec 22 10:47:22 2015 [14004]: VG! 0xdd  0xc2  0x12  0xac  0xf8 @ 
> 0xc7 ) 0xad  0xe2 B 0xd  0x95  0x9f  0x99 dY 0xb0 %t# 0xe1  0xaf  0xf9  0xc  0xa1 4 0xd5  0x88 bN 0x8  0x8a  0xab ^ 0xd4  0x94  0xff  0x14 Tue Dec 22 10:47:22 2015 [14004]: port:
> Tue Dec 22 10:47:22 2015 [14004]: 
> Tue Dec 22 10:47:22 2015 [14004]: rem_addr: 
> Tue Dec 22 10:47:22 2015 [14004]:  0x0  0x0  0x0  0x0  0x0  0x0  0x0  
> 0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0  0x0 
> Tue Dec 22 10:47:22 2015 [14004]: arg[0]: size=98

the size of arg0 exceeds the data length by itself.


> Tue Dec 22 10:47:27 2015 [14005]: session_id 3516540846 (0xd19a27ae), 
> Data length 92 (0x5c) Tue Dec 22 10:47:27 2015 [14005]: End header Tue 
> Dec 22 10:47:27 2015 [14005]: ACCT, flags=0xc6 method=6 priv_lvl=181 
> Tue Dec 22 10:47:27 2015 [14005]: type=125 svc=97 Tue Dec 22 10:47:27 
> 2015 [14005]: user_len=177 port_len=91 rem_addr_len=25 Tue Dec 22 
> 10:47:27 2015 [14005]: arg_cnt=105

again, argument length bytes exceed the data length.

nothing tacacs can do about that; garbage in - garbage out.