RADIUS does not encrypt the entire payload of the authentication packet; rather, it only encrypts the password in the Access-Request packet. The rest of the packet is transmitted in clear text, including usernames, thus it is partially vulnerable to sniffing.