Analyzer ppp_chap

This analyzer listens to the events ppp_chap_challenge_response and ppp_chap_success_failure events and create events containing the cryptographic material from the authentication.

It currently support MSCHAPv2 as described in RFC 2759 and CHAP-MD5.

Events

Name	Payload associated	Description
ppp_chap_mschapv2_auth	no	Details of a MSCHAPv2 authentication.
ppp_chap_md5_auth	no	Details of a MD5 authentication.

This event is generated each time someone succeed or fails to authenticate using MSCHAPv2.

Field	Type	Description
client	various	Client address. Can be an IP or a MAC or empty for raw PPP.
server	various	Server address. Can be an IP or a MAC or empty for raw PPP.
top_proto	string	Protocol encapsulating PPP if any.
vlan	uint16	VLAN where the authentication occurs if any.
identifier	uint8	Identifier of the authentication attempt.
username	string	Username who authenticated.
success	bool	True if the authentication succeeded.
auth_challenge	bytes	Challenge sent by the server.
response	bytes	Hashed client response.
peer_challenge	bytes	Peer challenge sent by the server.

This event is generated each time someone succeed or fails to authenticate using CHAP-MD5.

Field	Type	Description
client	various	Client address. Can be an IP or a MAC or empty for raw PPP.
server	various	Server address. Can be an IP or a MAC or empty for raw PPP.
top_proto	string	Protocol encapsulating PPP if any.
vlan	uint16	VLAN where the authentication occurs if any.
identifier	uint8	Identifier of the authentication attempt.
username	string	Username who authenticated.
success	bool	True if the authentication succeeded.
challenge	bytes	Challenge sent by the server.
response	bytes	Hashed response from the client.