PPTP

1. Introduction

The Point-to-Point Tunneling Protocol (PPTP) is al less used method for implementing virtual private networks. PPTP has many well known security issues.

PPTP uses a TCP control channel and a Generic Routing Encapsulation tunnel to encapsulate PPP packets. Many modern VPNs use various forms of UDP for this same functionality.

The PPTP specification does not describe encryption or authentication features and relies on the Point-to-Point Protocol beding tunneled to implement any and all security functionalites.

The PPTP implementation that ships with the Microsoft Windows product families implements various levels of authentication and encryption natively as standard features of the Windows PPTP stack. The intended use of this protocol is to porovide security levels and remote access levels comparable with typical VPN products.

A PPTP tunnel is instantiated by communication to the peer on TCP port 1723. This TCP connection is then used to initiate and manage a GRE tunnel to the same peer.  Data tuunel carries PPP packets encapsulated in GRE packets, which are carried over IP(IP protocol 47)

2. PPTP control connection message format

Each PPTP Control message begins with an fixed header, the follow figure shows this header.

          Figure 1.  PPTP control message header

Packet Length:

Totol length in octets of this PPTP message, includding the entire PPTP header.

Message Type:

1 for Control Message.

2 for Management Message.(Managnement messages are currently not defined)

Magic Coodie：

0x1A2B3C4D. This constant value is used as a sanity check on received message

Ctl Msg Type：

(Control Connection Management)

1 Start-Control-Connection-Request

2 Start-Control-Connection-Reply

3 Stop-Control-Connection-Request

4 Stop-Control-Connection-Request

5 Echo-Request

6 Echo-Reply

(Call Management）

7 Outgoing-Call-Request

8 Outgoing-Call-Reply

9 Incoming-Call-Request

10 Incoming-Call-Reply

11 Incoming-Call-Connected

12 Call-Clear-Request

13 Call-Disconnect-Notify

(Error Reporting)

14 WAN-Error-Notify

15  Set-Link-Info

Call ID (Peer Call ID):

A unique identifier assigned by PAC or PNS to this session. It is used to multiplex and demultiplex data sent over the tunnel between the PNS and PAC involved in this session.

2.1 PPTP data tunnel message format

PPTP data tunnel message in encapsulated as the following fugure.

              Figure2. PPTP data  message header

GRE header carries the Call-ID that the other end assigns for the session to which packet belongs. Following figure illustrates the format of the GRE Header.

             Figure 3.  GRE encapsulation header

2.2 PPTP call flow