About "Source Timestamp" and "Received Timestamp" in ISE Live log

[JustTakeTheFirstStep]

I want to know what equipment Source and Recive refer to in the livelog.

The device is using 1X authentication and ISE is associated with an AD server.

[Arne Bier]

Great question.  I have never thought about what this means.

The RADIUS Access-Request (UDP packets) does not contain any time stamp information. Therefore, I assume these timestamps must refer to some ISE components that are involved in the processing of the RADIUS Access-Request.

I am guessing "Source" refers to the time the RADIUS UDP packet was received from the network stack.

And "Received" refers to some other stage thereafter. But it's a very small time difference. In my lab, the timestamps are identical.  

I am hoping someone has the definitive answer.

[MHM Cisco World · Accepted solution]

[Arne Bier]

Nice image. Where did this come from?

Do you know what is meant by “The Radius”?

I could not find any timestamp in the RADIUS packet. Maybe I was in a hurry and missed it.

[MHM Cisco World]

https://www.ciscolive.com/c/dam/r/ciscolive/emea/docs/2020/pdf/BRKSEC-3229.pdf

I think this stamp is appear only when we use distribute in which MnT and PSN is separate 

hope I am right 

MHM 

[Arne Bier]

@JustTakeTheFirstStep - what does your setup look like? 

I can't find any examples in any of my ISE 3.1 or ISE 3.2 customers where there is any difference in this timestamp. And all my customers have distributed deployments.

I even checked with one customer who has an SNS server acting as PSN in a remote location over slow comms links - there is no difference there in the LiveLogs Auth Details timestamps.

The plot thickens ...

[hslai · Accepted solution]

@MHM Cisco World Standalone ISE also has them.

@JustTakeTheFirstStep I think the source is the ISE PSN performing the authentication and the source timestamp is when this ISE PSN sends out the event to the ISE MNT; the received timestamp is when the ISE MNT records it receives the event. If the clocks of all ISE nodes are properly synchronized and we should see little difference if low latency between ISE PSN and MNT.

[MHM Cisco World]

There is so little offset that why I think about distrubte mode not standalone.

MHM