Skip to main content
IMMUNITYSEC

Port 1812: Remote Authentication Dial In User Service (authentication)

UDP 1812 is the officially assigned RADIUS authentication port (RFC 2865); accounting uses 1813. RFC 2865 notes that early deployments used UDP 1645, and Microsoft still lists 1645 and 1646 as legacy RADIUS ports for its Internet Authentication Service. RADIUS carries authentication requests from a Network Access Server (NAS), acting as the client, to a central server.

1812
UDP

Port Details

Port
1812
Transport
UDP
Service
RADIUS
IANA service name
radius
Range
User port (1024-49151)
Related ports
1813164516462083

Security Exposure

Classic RADIUS over UDP relies on an MD5-based construction and a shared secret to authenticate server responses. The Blast-RADIUS research (CVE-2024-3596) showed that an attacker who can intercept and modify RADIUS/UDP traffic can forge an Access-Accept by combining a protocol flaw with an MD5 chosen-prefix collision. The researchers note that sending RADIUS/UDP over the open internet is discouraged but still happens in practice.

Hardening

  • +Upgrade RADIUS servers first, then clients and network access servers, to versions that send and require the Message-Authenticator attribute.
  • +Configure both sides to require Message-Authenticator on all requests and responses, as the Blast-RADIUS mitigation guidance advises.
  • +Move RADIUS traffic that crosses untrusted networks to RADIUS over TLS (RadSec, TCP 2083, RFC 6614).
  • +Allow UDP 1812 and 1813 only between known network access servers and the RADIUS servers, and use long random shared secrets.

Monitoring

Log Access-Reject volumes per client and alert on RADIUS packets from addresses that are not configured clients. Track which network access servers send requests without the Message-Authenticator attribute.

Tools for Auditing and Monitoring RADIUS

Wireshark

Open Source
Network Monitoring Tools

Network packet analyzer and protocol inspection tool for capturing live traffic and debugging network communications in detail.

LicenseGPL-2.0-or-later
PlatformWindows, macOS, Linux, BSD

Zeek

Open Source
Network Monitoring Tools

Network security monitoring framework that translates raw packet traffic into structured transaction logs and network events.

LicenseBSD-3-Clause
PlatformLinux, FreeBSD, macOS, OpenBSD

Nmap

Free / Commercial
Penetration Testing Tools

Network discovery scanner and port auditor for discovering live hosts, open ports, running services, and OS fingerprints.

LicenseNPSL-0.95 (Nmap Public Source License, not OSI-approved)
PlatformLinux, macOS, Windows

Related Tool Categories

IAM Tools→

Secrets managers, identity engines, and access control platforms for managing credentials and privilege.

Network Security Tools→

Zero trust access, secure web gateways, firewalls, and perimeter enforcement platforms.

Frequently Asked Questions

Is RADIUS port 1812 TCP or UDP?→

RADIUS uses UDP 1812 for authentication and UDP 1813 for accounting. RADIUS over TLS (RadSec) runs on TCP 2083.

What is the difference between ports 1812 and 1645?→

RFC 2865 explains that early RADIUS deployments used UDP 1645, which conflicts with another service, and that 1812 is the officially assigned port. Some systems still accept 1645 and 1646 for compatibility.

What is Blast-RADIUS?→

Blast-RADIUS (CVE-2024-3596) is an attack on RADIUS/UDP that forges server responses using an MD5 collision. The recommended mitigation is to require the Message-Authenticator attribute and, longer term, to carry RADIUS inside TLS.

Sources

Port assignments from the IANA Service Name and Transport Protocol Port Number Registry. Services can be configured to run on any port, so traffic on port 1812 is not guaranteed to be RADIUS. Exploited-in-the-wild data from the CISA KEV catalog (CC0).