---
name: "radiusctl"
section: "8"
platform: "openbsd"
package: "man"
version: "8.0-current-20261101"
release: "OpenBSD 8.0-current (2026-11-01)"
platforms: ["openbsd"]
url: "https://new.carta.tech/radiusctl"
---

# radiusctl(8)

control the RADIUS protocol daemon

## NAME

**radiusctl** – control the RADIUS protocol daemon

## SYNOPSIS

**radiusctl** *command* \[*argument* *...*\]

## DESCRIPTION

The **radiusctl** utility controls the [radiusd(8)](/radiusd/8.md) daemon.

The following commands are available:

-

  **test** *hostname* *radius\_secret* *user\_name* \[options\] Sends a RADIUS authentication request packet and shows the result. The request is for the user specified by *user\_name* and sent to the RADIUS server specified by *hostname*. *radius\_secret* is the shared secret with the server. The options are as follows:

  - **interval** *seconds*

    Specifies how many seconds to wait before resending a packet. The default is 2.

  - **maxwait** *seconds*

    Specifies the maximum amount of time to wait for a valid reply packet. The default is 8.

  - **method** *method*

    Use *method* for authentication. It can be either **pap**, **chap**, or **mschapv2**. If this option is omitted, **pap** is used.

  - **nas-port** *nas-port*

    Specify an integer value for the NAS-Port attribute in the packet. If this option is omitted, 0 is used.

  - **password** *password*

    Use *password* for *user\_name*.

  - **port** *port*

    Use *port* when sending a packet to *hostname*. If the port is omitted, the default port number 1812 is used.

  - **tries** *number*

    Specifies the number of packets to try sending. The default is 3.

  - **msgauth** *yes* \| *no*

    Specifies if Message-Authenticator is given for the access request packet. The default is yes.

- **ipcp** **show**

  Show all ipcp sessions in the database of [radiusd\_ipcp(8)](/radiusd_ipcp/8.md) briefly.

- **ipcp** **dump** \[**-json**\]

  Dump all ipcp sessions in the database of [radiusd\_ipcp(8)](/radiusd_ipcp/8.md). When **-json** is specified, **radiusctl** shows the sessions in JSON format.

- **ipcp** **monitor** \[**-json**\]

  Monitor the database of [radiusd\_ipcp(8)](/radiusd_ipcp/8.md), show newly created sessions and deleted sessions. When **-json** is specified, **radiusctl** shows the sessions in JSON format.

- **ipcp** **disconnect** *sequence*

  Request to disconnect the session specified by the *sequence*.

- **ipcp** **delete** *sequence*

  Request to delete the session specified by the *sequence* without requesting disconnection.

## EXAMPLES

```
(show all sessions)
$ doas radiusctl ipcp show
Seq Assigned        Username               Start    Tunnel From
--- --------------- ---------------------- -------- -------------------------
 21 192.168.1.99    mifune@example.jp      11:35AM  203.0.113.32:34859
 22 192.168.1.103   nakadai@example.jp     11:56AM  192.0.2.4:61794
$
(disconnect Nakadai's session)
$ doas radiusctl ipcp disconnect 22
$
```

## SEE ALSO

[radiusd(8)](/radiusd/8.md), [radiusd\_ipcp(8)](/radiusd_ipcp/8.md)