Contents 1. Overview of PPP 2. SLIP - Serial Line IP 3. PPP protocol features 4. PPP Protocol Stack 5. PPP framing 6. LCP and NCP 7. Typical PPP session 8. PPP authentication
indigoo.com
PPP
Peter R. Egli 2013
1 Rev. 2.50
PPP - Point to Point Protocol RFC1661
1. Overview of PPP
indigoo.com
Layer2 protocols run on lines (serial, dial-up) that do not provide a framing (raw bit pipes). PPP is a collection of protocols; each of these protocols provides a specific function. Client (initiator) Server (responder) IP IP IP IP
IP IP: 1.2.3.4 DNS: 2.3.4.5 NCP
Exchange of IP packets
IP
Assignment of IP address, DNS server
NCP
Your IP: 1.2.3.4 and DNS: 2.3.4.5
PAP CHAP EAP
Authentication of user Tell me who you are I am user@domain.com+password Link (layer 2) establishment and option negotiation I want compression ok
PAP CHAP EAP
LCP
LCP
HDLC
HH
Payload
HT
HH
Payload
HT
HH
Payload
HT
HDLC
Framing (message boundary) Phy Physical bit transport
Peter R. Egli 2013 2 Rev. 2.50
Phy
PPP - Point to Point Protocol RFC1661
2. SLIP (Serial Line IP, RFC1055) versus PPP
indigoo.com
SLIP was used as framing protocol over serial lines before the advent of PPP. SLIP framing: Frame delimiter: The byte 0xC0 serves as frame delimiter. Transparency: 0xDB, 0xDC is used as escape sequence for 0xC0 in payload: 0xC0 in payload becomes 0xDB 0xDC in SLIP frame. 0xDB in payload becomes 0xDB 0xDD in SLIP frame. SLIP has some deficiencies: 1. SLIP does not have error detection mechanism (left to TCP to detect and recover from errors on the transmission line). 2. SLIP only supports IP (no other layer 3 protocols). 3. SLIP does not provide dynamic IP address assignment. 4. SLIP does not provide authentication. PPP was devised in order to overcome the deficiencies of SLIP.
Peter R. Egli 2013
3 Rev. 2.50
PPP - Point to Point Protocol RFC1661
3. PPP (RFC1661 et.al.) protocol features
indigoo.com
PPP is not a single protocol but a protocol suite and consists of: 1. Framing method (frame/packet delineation): Serial lines provide bit transport, thus a means for finding the start of packets is required. 2. Link control protocol (LCP): LCP is used for establishing a data link including options for the operation. 3. Network control protocol (NCP): Each network protocol, e.g. IP, has its own NCP for establishing and configuring the network-layer operation. 4. Authentication protocols (CHAP, PAP, EAP): Client (and optional server) authentication make sure the right communication partners talk to each other. 5. Encryption protocols (ECP, DES, AES etc.) for privacy. 6. Bandwidth control (BACP): Bonding of multiple channels (Multilink PPP-MLPPP) to provide more bandwidth. 7. Compression control (CCP). Serial lines are usually comparably slow. Compression provides more throughput. PPP affords error detection (checksum). PPP allows to dynamically assign an IP address (NCP). PPP provides authentication (PAP / CHAP) PPP is a symmetric protocol: the 2 parties in a PPP session are the initiator (I, usually client) and the responder (R, usually server). Peter R. Egli 2013 4 Rev. 2.50
PPP - Point to Point Protocol RFC1661
4. PPP protocol stack CCP IPCP ECP PAP / CHAP / EAP BCP
indigoo.com BAP/BACP LQR / LQM
LCP CCP Compression Control Protocol: Negotiation and control of compression HDLC-like framing on both ends of link. IPCP IP Control Protocol (is a NCP Network Control Protocol): Establishment of IP on both ends of point-to-point link (mainly assignment of IP address, default gateway and DNS server from responder to initiator). BCP Bridging Control Protocol: Establishment of bridging modules on both ends of point-to-point link (similar to IPCP, but instead of routing initializes bridging). BAP/BACP Bandwidth Allocation (Control) Protocol: BAP/BACP can be used to add/remove individual links in a multi-link bundle (MultiLink PPP). ECP Encryption Control Protocol: Configuring and enabling of encryption on both ends of the link. CHAP CHallenge Authentication Protocol: Description see below. PAP Password Authentication Protocol: Description see below. EAP Extensible Authentication Protocol: Protocol supporting a range of authentication algorithms/protocols LCP Link Control Protocol: Negotiation and control of link parameters on both ends (MRU Max. Receive Unit, header compression, encapsulation). LQR Link Quality Report: Monitoring of link quality. Peter R. Egli 2013 5 Rev. 2.50
PPP - Point to Point Protocol RFC1661
5. PPP framing PPP framing is a variant of HDLC (High Level Data Link Control). 1 Flag=0x7E 1 Address 11111111 1 Control 00000011 1 or 2 Protocol variable Payload 2 or 4 Checksum
indigoo.com
1 Flag=0x7E
PPP framing is character oriented (frame always integral number of bytes (byte stuffing). The field address is fixed = 11111111b which means that all stations are to accept the frame.
Control = 00000011b which means that the frame is unnumbered (PPP does provide error detection, but no error correction; reliable transmission with PPP is set forth in RFC1663). The protocol field identifies the Layer 3 protocol contained in the payload (values see IANA assigned numbers). The payload is variable length (default 1500 bytes). The checksum is either a 2 byte CRC16 (default) or 4 byte CRC32 (frame > 4kB).
Peter R. Egli 2013
6 Rev. 2.50
PPP - Point to Point Protocol RFC1661
6. LCP and NCP A. LCP (Link Control Protocol): Used for establishing the link. Allows to negotiate link options: Authentication protocol to be used. Header compression / address field compression. MRU (maximum receive unit). Periodically test the link (LCP Echo request / reply).
indigoo.com
Bring down the link gracefully when no longer in use.
B. NCP (Network Control Protocol): Dynamic assignment of IP address. Dynamic assignment of DNS primary and secondary server. The host must set a default route to the PPP interface since there is no default gateway IP address (the link is point-to-point with no IP address = unnumbered).
PAP and CHAP are used for Authentication with PPP (is the one I am talking to the one he pretends to be?). PAP RFC1661 Password Authentication Protocol: * PAP simply sends a username and password (cleartext) to the remote computer. * Thus PAP is considered insecure. * PAP is symmetric and does not allow asymmetric settings with an authenticator and a peer (authenticator authenticates peer). CHAP RFC1994 Challenge Handshake Authentication Protocol: * With CHAP an authenticator (usually server) authenticates a peer (usually client); thus CHAP is asymmetric. * CHAP procedure: 1. Authenticator computes random value (=challenge) 2. Authenticator sends challenge (random value to foil replay attacks) to peer. 3. Peer computes a hash (MD5) value on identifier (username), secret (password) and challenge. 4. Peer sends hash value to authenticator. 5. Authenticator performs the same calculation and checks if the result is ok. * CHAP trace see PPP trace above. 9 Rev. 2.50
