Microsoft Windows Server 2003 TCP/IP Protocols and Services Technical Reference Slide: 1 Lesson 4 Point to Point Protocol (PPP)

Microsoft Windows Server 2003 TCP/IP Protocols and Services Technical Reference Slide: 2 Point to Point Protocol (PPP) PPP overview PPP connection process LCP PPP authentication protocols NCPs PPPoE

Microsoft Windows Server 2003 TCP/IP Protocols and Services Technical Reference Slide: 3 PPP Overview A Data Link Layer encapsulation method A protocol for negotiating the Data Link Layer characteristics named the Link Control Protocol (LCP) A series of protocols for negotiating Network Layer protocols over the point-to-point connection named Network Control Protocols (NCPs)

Microsoft Windows Server 2003 TCP/IP Protocols and Services Technical Reference Slide: 4 PPP Connection Process 1. PPP configuration using LCP 2. Authentication 3. Callback 4. Protocol configuration using NCPs

Microsoft Windows Server 2003 TCP/IP Protocols and Services Technical Reference Slide: 5 LCP Frame Structure Flag Address Control Protocol Code Identifier Length Data Frame Check Sequence Flag = 0x7E = 0xFF = 0x03 = 0xC0-21 = 0x7E... LCP Frame

Microsoft Windows Server 2003 TCP/IP Protocols and Services Technical Reference Slide: 6 LCP Options Protocol Code Identifier Length Type Length Option Data = 0xC LCP Option

Microsoft Windows Server 2003 TCP/IP Protocols and Services Technical Reference Slide: 7 LCP Negotiations LCP messages Configure-Request Configure-Nak Configure-Reject Configure-Ack For Peer A and Peer B: Peer A initiates an LCP negotiation for the data to be sent by Peer B Peer B initiates a separate LCP negotiation for the data to be sent by Peer A

Microsoft Windows Server 2003 TCP/IP Protocols and Services Technical Reference Slide: 8 PPP Authentication Protocols Password Authentication Protocol (PAP) Challenge Handshake Authentication Protocol (CHAP) Microsoft Challenge Handshake Authentication Protocol (MS-CHAP) MS-CHAP version 2 (MS-CHAP v2) Extensible Authentication Protocol (EAP)

Microsoft Windows Server 2003 TCP/IP Protocols and Services Technical Reference Slide: 9 PAP Very simple, plaintext authentication protocol PAP authentication process: 1. Connection-initiating PPP peer (the calling peer) sends a PAP Authenticate-Request message to the authenticating PPP peer (the answering peer) 2. The answering peer validates the user name and password and sends either a PAP Authenticate- Ack or PAP Authenticate-Nak message

Microsoft Windows Server 2003 TCP/IP Protocols and Services Technical Reference Slide: 10 PAP Authentication Request Frame Structure Protocol Code Identifier Length Peer ID Length Peer ID Password Length Password = 0xC = 1...

Microsoft Windows Server 2003 TCP/IP Protocols and Services Technical Reference Slide: 11 PAP Authenticate-Ack and Authenticate-Nak Protocol Code Identifier Length Message Length Message = 0xC = 2 or 3

Microsoft Windows Server 2003 TCP/IP Protocols and Services Technical Reference Slide: 12 CHAP More secure authentication protocol Provides proof of knowledge of password without sending the password CHAP authentication process 1. The answering peer sends a CHAP Challenge message that contains a challenge string 2. The calling peer sends a CHAP Response message that contains an MD5 hash of the CHAP session ID, the challenge string, and the user’s password 3. The answering peer verifies hash and sends a CHAP Success or CHAP Failure message

Microsoft Windows Server 2003 TCP/IP Protocols and Services Technical Reference Slide: 13 CHAP Challenge/Response Protocol Code Identifier Length Value Size Value Name = 0xC

Microsoft Windows Server 2003 TCP/IP Protocols and Services Technical Reference Slide: 14 CHAP Success/Failure Protocol Code Identifier Length Message = 0xC

Microsoft Windows Server 2003 TCP/IP Protocols and Services Technical Reference Slide: 15 MS-CHAP Microsoft authentication protocol Provides proof of knowledge of password without sending the password Uses MD-4 hash of the user’s password rather than a plaintext version MS-CHAP authentication process 1. The answering peer sends a CHAP Challenge message that contains a challenge string 2. The calling peer sends an MS-CHAP Response message that contains an encrypted response using the MD-4 hash of the user’s password 3. The answering peer verifies response and sends a CHAP Success or CHAP Failure message

Microsoft Windows Server 2003 TCP/IP Protocols and Services Technical Reference Slide: 16 MS-CHAP Response Protocol Code Identifier Length Value Size LAN Manager Response Windows NT Response Flags Name = 0xC (24 bytes) = 49

Microsoft Windows Server 2003 TCP/IP Protocols and Services Technical Reference Slide: 17 MS-CHAP v2 Microsoft authentication protocol MS-CHAP with mutual authentication MS-CHAP v2 authentication process 1. The answering peer sends a CHAP Challenge message that contains a challenge string 2. The calling peer sends an MS-CHAP v2 Response message that contains an encrypted response and a challenge for the answering peer 3. The answering peer verifies the response and sends a CHAP Success message with an encrypted response based on the calling peer’s challenge 4. The calling peer verifies the answering peer’s response

Microsoft Windows Server 2003 TCP/IP Protocols and Services Technical Reference Slide: 18 MS-CHAP v2 Response Protocol Code Identifier Length Value Size Peer Challenge Reserved Windows NT Response Flags Name = 0xC (16 bytes) (8 bytes)... (24 bytes) = 49

Microsoft Windows Server 2003 TCP/IP Protocols and Services Technical Reference Slide: 19 EAP An extension to PPP to allow for more extensibility and flexibility for authentication methods for PPP connections EAP messages: EAP-Request EAP-Response EAP-Success EAP-Failure

Microsoft Windows Server 2003 TCP/IP Protocols and Services Technical Reference Slide: 20 EAP Request/Response Message Protocol Code Identifier Length Type Type-specific data = 0xC = 1 or 2

Microsoft Windows Server 2003 TCP/IP Protocols and Services Technical Reference Slide: 21 EAP Success/Failure Message Protocol Code Identifier Length = 0xC2-27 = 3 or 4 = 4

Microsoft Windows Server 2003 TCP/IP Protocols and Services Technical Reference Slide: 22 EAP MD5 CHAP Request/Response Messages Protocol Code Identifier Length Type Value Size Value Name = 0xC2-27 = 1 or 2 = 4... = 16 (16 bytes)

Microsoft Windows Server 2003 TCP/IP Protocols and Services Technical Reference Slide: 23 NCPs IP Control Protocol (IPCP) IP Compression Protocol IP Address Primary DNS Server Address Primary NBNS Server Secondary DNS Server Address Secondary NBNS Server Compression Control Protocol (CCP) Microsoft Point-Compression (MPPC) Microsoft Point-to-Point Encryption (MPPE) Encryption Control Protocol (ECP)

Microsoft Windows Server 2003 TCP/IP Protocols and Services Technical Reference Slide: 24 PPP over Ethernet (PPPoE) Method of encapsulating PPP frames so that they can be sent over an Ethernet network PPPoE connection phases: 1. Discovery phase  Presence of an access concentrator (AC)  Determine a PPPoE session ID 2. PPP session phase  A PPP connection is established and used for data transfer

Microsoft Windows Server 2003 TCP/IP Protocols and Services Technical Reference Slide: 25 Destination Address Source Address PPPoE payload... EtherType Frame Check Sequence Preamble ,494 bytes Version Type Code Session ID Length = 1 PPPoE Frame Format

Microsoft Windows Server 2003 TCP/IP Protocols and Services Technical Reference Slide: 26 PPPoE Frame Format for PPP Frames

Microsoft Windows Server 2003 TCP/IP Protocols and Services Technical Reference Slide: 27 Review PPP overview PPP connection process LCP PPP authentication protocols NCPs PPPoE