NAC Tracer
Debug authentication flows step by step
What Is NAC Tracer?
NAC Tracer is your window into what Warden does during authentication. When something doesn't work, NAC Tracer shows you exactly what happened - every step, every decision, every attribute. No more guessing.
Think of it as a debug log with a friendly interface. Instead of grep'ing through text files, you get a visual trace of the authentication flow.
When to Use NAC Tracer
- Authentication fails - See exactly why it was rejected
- Wrong VLAN assigned - Check which attributes were returned
- Policy debugging - Verify which rules matched
- 2FA issues - See if 2FA was required, provided, or failed
- Performance analysis - Identify slow identity providers
- Learning Warden - Understand how authentication flows work
How NAC Tracer Works
NAC Tracer is always running in the background. Every authentication attempt is captured and stored automatically - you don't need to "start" a trace. Just open NAC Tracer and your authentication history is already there.
Traces are retained for 90 days, or longer for high-volume deployments based on available disk space.
Use the pause button to freeze the live feed while you examine a specific trace without new events pushing it off screen.
- Navigate to NAC Tracer in the sidebar
- View authentication events as they stream in real-time
- Click Pause to freeze the output while examining traces
- Use filters to narrow down to specific users, hosts, or time ranges
- Click any trace to see the full step-by-step authentication flow
Tip: If you're troubleshooting, try authenticating and then check NAC Tracer - your attempt will already be captured. Use filters if there's a lot of other traffic.
Reading a Trace
Each trace shows the authentication journey as a series of steps:
Step Types
Step completed successfully
Step failed - usually indicates why auth failed
Step not needed (e.g., 2FA not required)
Informational - additional context
Trace Details
Click any step to see full details:
Exact time and duration of each step
RADIUS attributes received from the network device
Which provider was queried and its response
Username, groups, and attributes from directory
Which policy and rules were evaluated
All RADIUS attributes returned in Access-Accept
Filtering Traces
With lots of traffic, use filters to find specific authentications:
Exporting Traces
Export traces for deeper analysis or to share with support:
- Select the trace(s) you want to export
- Click Export
- Choose format (JSON for programmatic use, or readable text)
- Download the file
For support tickets: Include an exported trace when reporting authentication issues. It gives us everything we need to help quickly.