Directory & authenticationUDP 1812, 1813 Encrypted
Port 1812, 1813: RADIUS
RADIUS
Centralised authentication (1812) and accounting (1813) for network access, VPN and Wi-Fi (802.1X).
How attackers abuse it
- Only the password field is protected; other attributes are visible.
- Weak shared secrets between clients and the server.
How to defend it
- Long random shared secrets; restrict clients.
- RADIUS over TLS (RadSec) where available.
Exam tip
RADIUS: UDP, encrypts only the password, combines authentication and authorisation. TACACS+: TCP 49, encrypts the whole payload, separates AAA.