The text speaks of RADIUS servers; the figures (i.e., in 2.1) speak of clients. 5.4 -- Servers (shouldn't that be NASs?) SHOULD be configurable to reject messages without the Event-Timestamp option. --Steve Bellovin, http://www.research.att.com/~smb (me) http://www.wilyhacker.com (2nd edition of "Firewalls" book)