Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. If you'd prefer to explore, try our test area to get started. And see here for current known issues.

New Member

in which layer the ppp protocol passwords are stored

Hello all,

You never learn if you do not ask, regardless the asked question.

I was reading through PPP protocol, where it authenticates two connected peers using either PAP or CHAP. I was wondering where the username/password are stored in the OSI model? Is it L2, L3...etc.

I noticed that the passwords are configured in the routers and routers work on L3. Does that mean the password are stored in L3 headers? If so, we cant we use Ethernet for authentication then?

I know the question might not sound right, but I am sooooooo confused.

Thanks

1 ACCEPTED SOLUTION

Accepted Solutions
Silver

Hi a.azab,

Hi a.azab,

I was reading through PPP protocol, where it authenticates two connected peers using either PAP or CHAP. I was wondering where the username/password are stored in the OSI model? Is it L2, L3...etc.

ppp authenticate during the LCP phase that is a layer 2 protocol. Here a debug of ppp authentication using PAP:

*Mar  1 00:23:33.655: Se0/0 LCP: I CONFREQ [Open] id 187 len 10
*Mar  1 00:23:33.655: Se0/0 LCP:    MagicNumber 0x032E73A8 (0x0506032E73A8)
*Mar  1 00:23:33.659: Se0/0 CDPCP: State is Closed
*Mar  1 00:23:33.659: Se0/0 IPCP: State is Closed
*Mar  1 00:23:33.663: Se0/0 PPP: Phase is TERMINATING
*Mar  1 00:23:33.663: Se0/0 PPP: Phase is ESTABLISHING
*Mar  1 00:23:33.663: Se0/0 LCP: O CONFREQ [Open] id 126 len 14
*Mar  1 00:23:33.667: Se0/0 LCP:    AuthProto PAP (0x0304C023)
*Mar  1 00:23:33.667: Se0/0 LCP:    MagicNumber 0x02303AF2 (0x050602303AF2)
*Mar  1 00:23:33.667: Se0/0 LCP: O CONFACK [Open] id 187 len 10
*Mar  1 00:23:33.667: Se0/0 LCP:    MagicNumber 0x032E73A8 (0x0506032E73A8)
*Mar  1 00:23:33.675: Se0/0 IPCP: Remove route to 172.16.23.3
*Mar  1 00:23:33.679: Se0/0 LCP: I CONFACK [ACKsent] id 126 len 14
*Mar  1 00:23:33.679: Se0/0 LCP:    AuthProto PAP (0x0304C023)
*Mar  1 00:23:33.683: Se0/0 LCP:    MagicNumber 0x02303AF2 (0x050602303AF2)
*Mar  1 00:23:33.683: Se0/0 LCP: State is Open
*Mar  1 00:23:33.683: Se0/0 PPP: Phase is AUTHENTICATING, by this end
*Mar  1 00:23:33.683: Se0/0 PAP: I AUTH-REQ id 13 len 13 from "R2"
*Mar  1 00:23:33.687: Se0/0 PAP: Authenticating peer R2

In attached packet capture you can see that PAP in inside PPP packet and user/password are stored inside PAP (in clear text).

I noticed that the passwords are configured in the routers and routers work on L3. Does that mean the password are stored in L3 headers?

Routers are layer 3 device this mean that they can operate at layer 3, but working at layer 3 requires to work also at layer 1 and 2 (and for some feature routers operate also at layer 4 to 7). For example to route a packet between two Ethernet interfaces, router has to decapsulate ip packet form Ethernet, decrease TTL and calculate checksum in IP header and finally create a new layer 2 header to encapsulate the IP packet (obviously this is a very simplified view of the process). 

The layer where users and password are "stored"  (note that not all authentication protocols send password, for example chap use a different authentication scheme) depends on the specific protocols. For example in telnet the password is stored inside Telnet packets so at layer 7.

If so, we cant we use Ethernet for authentication then?

Ethernet has it's own authentication protocols, for example 802.1x, but usually they are used to authenticate IP host.    If you re using PPP between to router is because you have a serial connection not an Ethernet link

Hope this help, bye

enrico

PS rate if useful

1 REPLY
Silver

Hi a.azab,

Hi a.azab,

I was reading through PPP protocol, where it authenticates two connected peers using either PAP or CHAP. I was wondering where the username/password are stored in the OSI model? Is it L2, L3...etc.

ppp authenticate during the LCP phase that is a layer 2 protocol. Here a debug of ppp authentication using PAP:

*Mar  1 00:23:33.655: Se0/0 LCP: I CONFREQ [Open] id 187 len 10
*Mar  1 00:23:33.655: Se0/0 LCP:    MagicNumber 0x032E73A8 (0x0506032E73A8)
*Mar  1 00:23:33.659: Se0/0 CDPCP: State is Closed
*Mar  1 00:23:33.659: Se0/0 IPCP: State is Closed
*Mar  1 00:23:33.663: Se0/0 PPP: Phase is TERMINATING
*Mar  1 00:23:33.663: Se0/0 PPP: Phase is ESTABLISHING
*Mar  1 00:23:33.663: Se0/0 LCP: O CONFREQ [Open] id 126 len 14
*Mar  1 00:23:33.667: Se0/0 LCP:    AuthProto PAP (0x0304C023)
*Mar  1 00:23:33.667: Se0/0 LCP:    MagicNumber 0x02303AF2 (0x050602303AF2)
*Mar  1 00:23:33.667: Se0/0 LCP: O CONFACK [Open] id 187 len 10
*Mar  1 00:23:33.667: Se0/0 LCP:    MagicNumber 0x032E73A8 (0x0506032E73A8)
*Mar  1 00:23:33.675: Se0/0 IPCP: Remove route to 172.16.23.3
*Mar  1 00:23:33.679: Se0/0 LCP: I CONFACK [ACKsent] id 126 len 14
*Mar  1 00:23:33.679: Se0/0 LCP:    AuthProto PAP (0x0304C023)
*Mar  1 00:23:33.683: Se0/0 LCP:    MagicNumber 0x02303AF2 (0x050602303AF2)
*Mar  1 00:23:33.683: Se0/0 LCP: State is Open
*Mar  1 00:23:33.683: Se0/0 PPP: Phase is AUTHENTICATING, by this end
*Mar  1 00:23:33.683: Se0/0 PAP: I AUTH-REQ id 13 len 13 from "R2"
*Mar  1 00:23:33.687: Se0/0 PAP: Authenticating peer R2

In attached packet capture you can see that PAP in inside PPP packet and user/password are stored inside PAP (in clear text).

I noticed that the passwords are configured in the routers and routers work on L3. Does that mean the password are stored in L3 headers?

Routers are layer 3 device this mean that they can operate at layer 3, but working at layer 3 requires to work also at layer 1 and 2 (and for some feature routers operate also at layer 4 to 7). For example to route a packet between two Ethernet interfaces, router has to decapsulate ip packet form Ethernet, decrease TTL and calculate checksum in IP header and finally create a new layer 2 header to encapsulate the IP packet (obviously this is a very simplified view of the process). 

The layer where users and password are "stored"  (note that not all authentication protocols send password, for example chap use a different authentication scheme) depends on the specific protocols. For example in telnet the password is stored inside Telnet packets so at layer 7.

If so, we cant we use Ethernet for authentication then?

Ethernet has it's own authentication protocols, for example 802.1x, but usually they are used to authenticate IP host.    If you re using PPP between to router is because you have a serial connection not an Ethernet link

Hope this help, bye

enrico

PS rate if useful

2
Views
0
Helpful
1
Replies