User Tools

Site Tools


pom-ng:analyzer:ppp_chap

Analyzer ppp_chap

This analyzer listens to the events ppp_chap_challenge_response and ppp_chap_success_failure events and create events containing the cryptographic material from the authentication.

It currently support MSCHAPv2 as described in RFC 2759 and CHAP-MD5.

Events

Name Payload associated Description
ppp_chap_mschapv2_authnoDetails of a MSCHAPv2 authentication.
ppp_chap_md5_authnoDetails of a MD5 authentication.

ppp_chap_mschapv2_auth

This event is generated each time someone succeed or fails to authenticate using MSCHAPv2.

Field Type Description
clientvariousClient address. Can be an IP or a MAC or empty for raw PPP.
servervariousServer address. Can be an IP or a MAC or empty for raw PPP.
top_protostringProtocol encapsulating PPP if any.
vlanuint16VLAN where the authentication occurs if any.
identifieruint8Identifier of the authentication attempt.
usernamestringUsername who authenticated.
successboolTrue if the authentication succeeded.
auth_challengebytesChallenge sent by the server.
responsebytesHashed client response.
peer_challengebytesPeer challenge sent by the server.

ppp_chap_md5_auth

This event is generated each time someone succeed or fails to authenticate using CHAP-MD5.

Field Type Description
clientvariousClient address. Can be an IP or a MAC or empty for raw PPP.
servervariousServer address. Can be an IP or a MAC or empty for raw PPP.
top_protostringProtocol encapsulating PPP if any.
vlanuint16VLAN where the authentication occurs if any.
identifieruint8Identifier of the authentication attempt.
usernamestringUsername who authenticated.
successboolTrue if the authentication succeeded.
challengebytesChallenge sent by the server.
responsebytesHashed response from the client.
pom-ng/analyzer/ppp_chap.txt · Last modified: 2013/12/02 16:37 by gmsoft