by WPA compliant access points and provides centralised authentication, authorisation and accounting services. To authenticate a wireless client seeking network access via an access point, the access point, acting as a client to the RADIUS server, sends a RADIUS message to the server which contains the user's credentials together with information on the requested connection parameters (Figure 8-5). The RADIUS server will either authenticate and authorise or reject the request, in either case sending back a response message. Authenticator Supplicant = Access server Authentication Wireless LAN Intranet / LAN = Client Server RADIUS message format Code Sequence Length Authenticator Attributes Description Access Request Access Accept EAP request and response messages EAP messages encapsulated Access Reject carried as EAPOL packets Accounting Request as RADIUS message attributes Accounting Response Access Challenge Figure 8-5: Message Format for EAP Over RADIUS Authentication Chapter Eight A RADIUS message comprises a RADIUS header and RADIUS attributes, with each attribute specifying a piece of information about the requested connection. For example, an Access-Request message will contain attributes for the user name and credentials, and the type of service and connection parameters being requested by the user, while the Access-Accept message contains attributes for the type of connection that has been authorised, relevant connection constraints and any vendor specific attributes. Extensible Authentication Protocol The extensible authentication protocol (EAP) builds on the framework for enabling remote access that was originally established for dial-up connections in the point-to-point protocol (PPP) suite of protocols. The PPP dial-up sequence provided for the negotiation of link and network control protocols, as well as the authentication protocol that would be used, based on the desired level of security. For example, an authentication protocol, such as password authentication protocol (PAP) or challenge- handshake