eap Mailing List: Re: Issue 339: Use of Session-Timeout

[Bernard Aboba (bernard_aboba]

> It would seem that the ISP would loose money if it gives 1 hr 10
> minutes, while charging for 1 hr. On the other hand if the user has a
> session that she knows will be 1 hr, then and I am guessing the peer
> client has no idea about session timeout value...

The Accounting-Start record is only sent when the Session actually starts, 
so that the pre-authentication caching time shouldn't affect the accuracy of 
the accounting records.

So I think the issue here is whether the ISP is able to accurately determine 
the maximum session time when pre-authentication is used.  802.11i has 
defined Session-Timeout to include the pre-authentication caching time, but 
as Avi has pointed out, this overloading may not necessarily be a good idea.

Since the 802.11i definition may already have been implemented, it may be 
too late to turn back the clock, but we can leave some leeway for future 
documents to define a new Preauthentication-Timeout attribute that might 
clean things up a bit.