Event ID 6274 NPS received from the network access server was malformed. Is there any way to know which part of the message is incorrect?

Question

Event ID 6274 is recorded.

The error message is as follows

How do I know what is wrong with the RADIUS message?

Network Policy Server discarded the request for a user
Reason Code : 3
Reason : The RADIUS Request message that Network Policy Server received from the network access server was malformed.

This phenomenon was observed on Windows Server 2012R2 Standard and 2022 Standard.

I have performed a packet capture.

I used Wireshark to compare discarded and non-discarded packets and could not identify the problem.

Both packets appeared to be RFC compliant.

Can I see a stack trace of the process in Windows Server?

How do I know which part of the packet was determined to be malform?

Below is the RADIUS portion of the packet captured by Wireshark.

RADIUS Protocol
    Code: Access-Request (1)
    Packet identifier: 0x71 (113)
    Length: 154
    Authenticator: 222e69f1d7d3e449b6fb4abd3cbf0337
    [The response to this request is in frame 3176]
    Attribute Value Pairs
        AVP: t=User-Name(1) l=19 val=**********
        AVP: t=Chargeable-User-Identity(89) l=3 val=\000
        AVP: t=Calling-Station-Id(31) l=19 val=**:**:**:**:**:**
        AVP: t=NAS-IP-Address(4) l=6 val=172.**.***.***
        AVP: t=NAS-Identifier(32) l=15 val=********
        AVP: t=NAS-Port-Type(61) l=6 val=Wireless-802.11(19)
        AVP: t=EAP-Message(79) l=24 Last Segment[1]
        AVP: t=Message-Authenticator(80) l=18 val=83c704b2b01573050e92f5ad8365ccb5
        AVP: t=Proxy-State(33) l=4 val=3831
        AVP: t=Operator-Name(126) l=16 val=**********
        AVP: t=Proxy-State(33) l=4 val=3131

Answer 1

Hello techagent,

A limited amount of tracing is possible, but the trace data is difficult to interpret; judging by the limited amount of discussion of this topic that I could find on the Web, almost no-one tries this.

The command "netsh ras show tracing" (or, possibly, "netsh nps show tracing") shows trace sources that can be enabled for textual logging to \Windows\tracing (with the command "netsh ras set tracing"), but often no trace data is written unless WPP tracing is also enabled (the trace mask and level set on the WPP tracing also affects the textual tracing).

The textual log data looks like this:

If you are prepared to share the trace data, then I would be happy to help with its analysis.

Gary