User Tools

Site Tools


pom-ng:analyzer:ppp_chap

This is an old revision of the document!


A PCRE internal error occured. This might be caused by a faulty plugin

====== Analyzer ppp_chap ====== This analyzer listens to the events [[pom-ng:proto:ppp_chap#ppp_chap_challenge_response]] and [[pom-ng:proto:ppp_chap#ppp_chap_success_failure]] events and create events containing the cryptographic material from the authentication. It currently support [[wp>MS-CHAP|MSCHAPv2]] as described in RFC [[rfc>2759]] and CHAP-MD5. ===== Events ===== ^ Name ^ Payload associated ^ Description ^ |ppp_chap_mschapv2_auth|no|Details of a MSCHAPv2 authentication.| |ppp_chap_md5_auth|no|Details of a MD5 authentication.| ==== ppp_chap_mschapv2_auth ==== This event is generated each time someone succeed or fails to authenticate using MSCHAPv2. ^ Field ^ Type ^ Description ^ |client|various|Client address. Can be an IP or a MAC or empty for raw PPP.| |server|various|Server address. Can be an IP or a MAC or empty for raw PPP.| |top_proto|string|Protocol encapsulating PPP is any.| |vlan|uint16|VLAN where the authentication occurs if any.| |identifier|uint8|Identifier of the authentication attempt.| |username|string|Username who authenticated.| |success|bool|True if the authentication succeeded.| |auth_challenge|bytes|Challenge sent by the server.| |response|bytes|Hashed client response.| |peer_challenge|bytes|Peer challenge sent by the server.| ==== ppp_chap_md5_auth ==== This event is generated each time someone succeed or fails to authenticate using CHAP-MD5. ^ Field ^ Type ^ Description ^ |client|various|Client address. Can be an IP or a MAC or empty for raw PPP.| |server|various|Server address. Can be an IP or a MAC or empty for raw PPP.| |top_proto|string|Protocol encapsulating PPP is any.| |vlan|uint16|VLAN where the authentication occurs if any.| |identifier|uint8|Identifier of the authentication attempt.| |username|string|Username who authenticated.| |success|bool|True if the authentication succeeded.| |challenge|bytes|Challenge sent by the server.| |response|bytes|Hashed response from the client.|

pom-ng/analyzer/ppp_chap.1386002214.txt.gz · Last modified: 2013/12/02 16:36 by gmsoft