bytxl

pptp问题调试详解

Diagnosis HOWTO

by James Cameron
12th April 2006

You're probably here because you have a problem getting PPTP Client to work. There are many reasons why it can fail. Other people may have encountered the problem you have.

This HOWTO is a series of known problems in installation and running order. When the PPTP Client fails, it will display an error message. Search for the message in this page.

For some error messages, more detail will need to be gathered. This is done by enabling debug logging.

Near the end of the document, we also show a fault tree, and some additional documentation for using tools to determine what your problem is.

We thank the many contributors to this page. If you think you've found a solution to a common problem, please write it up in our problem,diagnosis, solution format, and submit it to the mailing list.

LCP ConfRej
No auth is possible
CCP: timeout sending Config-Requests
CCP ConfNak
LCP terminated by peer (peer refused to authenticate)
LCP terminated by peer (garbled text)
EAP Response ... LCP TermReq
CCP terminated by peer
CCP ConfRej
CCP: No compression negotiated
CCP ConfRej
MPPE required, but MS-CHAP[v2] auth not performed.
MPPE required but peer refused
MPPE required but peer negotiation failed
LCP TermReq id=0x3 "MPPE required but not available"
MPPE required, but kernel has no support.
Received bad configure-ack
LCP ConfNak id=0x1

Conventions

Conventions used in this document:

italic text, a program name or option keyword

monospaced text, a file name

blue background, error messages or log output

green background, commands to be entered

red background, quotation

yellow background with black vertical "change bar" on right hand side, text changed in this revision (or the last month)

Installing kernel modules

Installing pppd

ppp <= 2.3.15 conflicts with kernel

Symptom: when installing ppp-mppe-2.4.0-4.*.rpm on Red Hat 7.2 or later, this message appears:

error: failed dependencies: ppp <= 2.3.15 conflicts with kernel-2.4.7-10

On Red Hat 7.3, the kernel version is usually 2.4.18-3.

Diagnosis: the 2.4.0-4 ppp-mppe package provides a ppp package without a version. The newer Red Hat kernel packages require a specific version, and so the conflict occurs. Since pptp-linux 1.1.0 there is no longer a dependency on ppp-mppe, as many people don't need to interoperate with a Microsoft VPN Server.

Solution 1: use the kernelmod instructions which are part of the Red Hat 9.0 HOWTO. This alleviates the problem.

2003-05-02

Solution 2: Install the package with --nodeps.

rpm -Uvh --nodeps ppp-mppe-2.4.0-4.i386.rpm

The installation script should tell you that you will have to build the kernel module yourself. Follow the instructions provided with the notice to build the kernel module, then follow the instructions provided from the kernel module build to install the new module. Note that the kernel-sources package for your kernel needs to be installed to complete the build.

On Red Hat 7.3, edit /etc/modules.conf and add these lines:

alias char-major-108 ppp_generic alias ppp-compress-18 mppe

Installing pptp

Installing pptpconfig

Running pptpconfig

Fatal error: php-gtk: Could not open display

Symptom: trying to start pptpconfig results in an error;

Fatal error: php-gtk: Could not open display in /usr/bin/pptpconfig.php on line 31

which may be preceeded by

Xlib: connection to ":0.0" refused by server Xlib: Invalid MIT-MAGIC-COOKIE-1 key

Diagnosis: you have used su to become root but that is insufficient to pass on the access to the graphics display. This is a security feature of X-Windows.

Solution: see the command not found entry below, as it covers the same problem but from a different error message.

2006-08-21

Running pptp-command

insecure dependency

The pptp-command script is using a Perl feature to enhance software security design, but newer Perl versions are more exacting.

Problem: pptp-command fails with a message about an insecure dependency and the -T switch.

Solution 1: Install pptpconfig, and start it by typing pptpconfig. If you are not root, you will be prompted for the root password. You may find it much easier to configure than pptp-command.

Solution 2: upgrade to 1.2.0 or later of pptp-linux. If the problem continues, upgrade to the latest pptp-command from CVS.

2003-05-02

Workaround: remove the -T switch from the top of the pptp-command file. Report the version of Perl, and the exact text of the error message, so we can fix it.

WARNING: the line: contains unsafe characters

Problem: pptp-command fails to enter setup mode, and emits a long stream of similar errors

WARNING: the line: # whatever contains unsafe characters!

Solution 1: Install pptpconfig, and start it by typing pptpconfig. If you are not root, you will be prompted for the root password. You may find it much easier to configure than pptp-command.

2003-05-02

Solution 2: check for carriage return characters in the drop-in configuration file and remove them.

% od -c /tmp/config|grep "\n" % tr --delete '\r' < /tmp/config > /tmp/config.new

ERROR! Connection timed out

Problem: pptp-command fails to start tunnel:

ERROR! Connection timed out

Diagnosis: older versions of pptp-command did not check effectively for success. They waited for the network interface to be created. If this did not happen within the time allowed, the error would appear.

Solution: enable debug mode, start the tunnel manually, and look for the cause of the problem in the output. Check the rest of this document.

Upgrade to the pptp-command shipped in 1.2.0 to be told when the tunnel fails rather than wait for the timeout.

Consider an upgrade to pptpconfig. Synchronisation of the user interface with PPP is more straightforward, and it is easier to use.

2003-05-02

New interface not found

Problem: pptp-command fails to start tunnel:

New interface not found.

Diagnosis: pptp-command was told by pppd that the connection was established, but the network interface was no longer present. This is usually because pppd has failed after establishing the connection.

Solution: enable debug mode, start the tunnel manually, and look for the cause of the problem in the output. Check the rest of this document.

Upgrade to pptpconfig, and start it by typing pptpconfig. Re-enter your tunnel data. When it fails to establish the tunnel, more information is provided.

2003-05-02

Running pptp

pptp: command not found

Symptom: when trying to start pptp, pptpconfig, or pptpsetup as a non-root user, this message appears:

pptp: command not found

Diagnosis: the program is not in your PATH, or you are not running the program as the root user. This is a normal security feature of most systems.

The solutions depend on which program you are running.

pptpconfig

The pptpconfig program needs access to your X-Windows display, write access to /etc/ppp/peers, /etc/pptpconfig, and also needs to start pppd and pptp which themselves need root. Choose one of these methods:

configure sudo to allow a user to run pptpconfig as root without any password prompt, for example:

# echo ALL ALL=NOPASSWD: /usr/sbin/pptpconfig >> /etc/sudoers

add a desktop launcher item which runs this:

% sudo /usr/sbin/pptpconfig

and since pptpconfig presumes both pptp and ip are in the PATH, either create symlinks:

% ln -s /usr/sbin/pptp /usr/bin/pptp % ln -s /sbin/ip /bin/ip

or augment PATH in the usual fashion.
use kdesu if it is installed; type kdesu pptpconfig and press enter. You may be prompted for the root password, and then the pptpconfig window should appear.
use gksu if it is installed; type gksu pptpconfig and press enter. You may be prompted for the root password, and then the pptpconfig window should appear.
use gnomesu if it is installed; type gnomesu pptpconfig and press enter. You may be prompted for the root password, and then the pptpconfig window should appear.
use ssh to forward the X11 connection; type ssh -X root@localhost pptpconfig and press enter. You may be prompted for the root password. The sshmethod may not work if your /etc/ssh/sshd_config file has X11Forwarding set to no. Another security feature.
log in as root to begin with. On some distributions, you can configure the connection using pptpconfig as root, and then start the tunnel using pon tunnelname as an ordinary user.
adjust the definition of the menu option for pptpconfig by adding whichever wrapper above worked for you.

pptpsetup

The pptpsetup program needs write access to /etc/ppp/peers, /etc/pptpconfig, and also needs to start pppd and pptp. Choose one of these methods:

configure sudo to allow you to start pptpsetup, as described in the section above,
use ssh; type ssh root@localhost pptpsetup and press enter. You may be prompted for the root password.
log in as root to begin with. On some distributions, you can configure the connection using pptpsetup as root, and then start the tunnel using pon tunnelname as an ordinary user.
configure pptpsetup to be setuid root:

# chmod u+s `which pptpsetup`

pptp

pptp requires root privilege to create a raw socket for GRE packet transmission. pptp is in /usr/sbin, which is in the PATH for the root user. pptp is started bypppd. Follow this sequence:

make sure you are using pptp-client 1.1.0 or later,
as root, configure the tunnel with pptpconfig or pptpsetup, and test it, but then stop using pptpconfig or pptpsetup as the way to start it,
make pptp setuid root:

# chmod u+s `which pptp`
test that a pppd command can be used to start the tunnel:

# pppd call tunnel

where tunnel is the name of the tunnel configuration file. pppd knows to look in /etc/ppp/peers for the file.

If the tunnel does not start, enable debug logging, and try the pppd command again.
return to non-root user mode, and then use a normal GUI or console utilities (e.g. pon and poff) to start or stop the pppd connection named 'tunnel'.

# pon tunnel
you may need to add a host route to the PPTP server first, which is something that pptpconfig does for PPTP Client 1.7.1 and earlier,
if you used any special routing in pptpconfig then you will need to duplicate this at the command line. Enable debug logging in pptpconfig to see exactly what commands it is executing and when.

2006-08-21

connect: Connection Refused

Symptom: on starting pptp, three messages appear, followed by a delay:

warn[open_inetsock:pptp_callmgr.c:305]: connect: Connection refused fatal[callmgr_main:pptp_callmgr.c:128]: Could not open control connection to x.x.x.x fatal[open_callmgr:pptp.c:278]: Call manager exited with error 256

Diagnosis: the host that you provided has refused connection.

Solution: check the IP address or name of the PPTP Server, and check that the PPTP Server is running properly. Work through the Fault Tree from the top.

connect: Network is unreachable

Symptom: on starting pptp, three messages appear:

warn[open_inetsock:pptp_callmgr.c:305]: connect: Network is unreachable fatal[callmgr_main:pptp_callmgr.c:128]: Could not open control connection to x.x.x.x fatal[open_callmgr:pptp.c:278]: Call manager exited with error 256

Diagnosis: the host that you provided cannot be reached via the network. This is usually caused by not having an active internet connection at all.

Solution: check the IP address or name of the PPTP Server, and check that the PPTP Server is running properly. Work through the Fault Tree from the top.

connect: No route to host

Symptom: on starting pptp, three messages appear:

warn[open_inetsock:pptp_callmgr.c:305]: connect: No route to host fatal[callmgr_main:pptp_callmgr.c:128]: Could not open control connection to x.x.x.x fatal[open_callmgr:pptp.c:278]: Call manager exited with error 256

Diagnosis: the host that you provided cannot be reached via the network.

Solution: check the IP address or name of the PPTP Server, and check that the PPTP Server is running properly. Work through the Fault Tree from the top.

Input/output error

Symptom: the following messages appear before the tunnel is established:

log[pptp_dispatch_ctrl_packet:pptp_ctrl.c:580]: Client connection established. log[pptp_dispatch_ctrl_packet:pptp_ctrl.c:708]: Outgoing call established (call ID 0, peer's call ID 0). log[decaps_hdlc:pptp_gre.c:129]: short read (4294967295): Input/output error log[callmgr_main:pptp_callmgr.c:245]: Closing connection log[pptp_conn_close:pptp_ctrl.c:307]: Closing PPTP connection log[call_callback:pptp_callmgr.c:88]: Closing connection

Diagnosis: pppd was started by pptp but was unable to operate, and so terminated quickly. pptp tried to read data from pppd but found none. There are many reasons why pppd could have failed, but the most likely are configuration file errors.

Solution: Enable debug logging and check to see why pppd failed. Search this HOWTO for those messages.

Symptom: on a PPTP server running pptpd, the following message may appear when all incoming tunnel requests fail:

pptpd[5740]: GRE: read(fd=5,buffer=804dc00,len=8196) from PTY failed: status = -1 error = Input/output error

Diagnosis: pppd was started by pptpd but was unable to operate, and so terminated quickly. pptpd tried to read data from pppd but found none. There are many reasons why pppd could have failed, but the most likely are configuration file errors.

pptpd incorrectly hides all pppd error output. This is a defect and should be fixed. It apparently doesn't even wait for and report the pppd exit status.

Solution: check the configuration files. A simple typo will cause this error. It is easy to have pppd tell you where the typo is. Here is how:

Try running pppd against the configuration files in the same way that pptpd would run it. If you strace the pptpd, you can detect the command line given topppd (just after it says "launching pppd"), and then you can run that command manually in a shell to see what objections pppd has to the options.

When we did an strace just now, we got this line that was valuable;

12704 execve("/usr/sbin/pppd", ["/usr/sbin/pppd", "local", "file", "/etc/ppp/pptpd-options", "50", "10.0.1.1:10.0.1.3"], [/* 18 vars */]) = 0

This tells us that pptpd is trying to execute the following command to accept the tunnel connection from the client (we have speed 50 in our options file);

pppd local file /etc/ppp/pptpd-options 50 10.0.1.1:10.0.1.3

Running this command in a shell starts pppd negotiating with the keyboard and screen. After a while it times out. Adding the dryrun option allow us to test the syntax only. We added the word bogus to our pptpd-options file (your file name may differ), and the result was as follows:

pppd local file /etc/ppp/pptpd-options 50 10.0.1.1:10.0.1.3 dryrun pppd: In file /etc/ppp/pptpd-options: unrecognized option 'bogus'

pppd had returned an exit status of 2, which according to the manual page means "An error was detected in processing the options given, such as two mutually exclusive options being used."

Removing the word bogus caused pppd to exit with a status of 0. We used the shell command echo $? to check the exit status.

As to why the error messages from pppd are being ignored, the running pppd on our test server has file descriptor 2 (stderr) bound to a deleted pty. We presume this is a code fault in pptpd.

2003-09-02

Protocol not available

Symptom: the following messages appear before the tunnel is established:

log[pptp_dispatch_ctrl_packet:pptp_ctrl.c:580]: Client connection established. log[pptp_dispatch_ctrl_packet:pptp_ctrl.c:708]: Outgoing call established (call ID 0, peer's call ID 0). log[decaps_gre:pptp_gre.c:215]: short read (4294967295): Protocol not available log[callmgr_main:pptp_callmgr.c:245]: Closing connection log[pptp_conn_close:pptp_ctrl.c:307]: Closing PPTP connection log[call_callback:pptp_callmgr.c:88]: Closing connection

Diagnosis: usually caused by the client not binding to the GRE socket early enough during the connection sequence. The first GRE packet from the server causes an ICMP protocol unreachable reply. This happens more frequently on high speed connections.

Workaround: load the ip_gre module. This prevents the ICMP protocol unreachable reply from being generated.

# modprobe ip_gre

Solution: upgrade to pptp-linux 1.2.0, which binds the GRE socket prior to calling the server. Loading the ip_gre module should not be needed.

2003-05-02

Operation not permitted
Symptom: write to the GRE socket fails with EPERM.
Diagnosis: iptables rules (such as for a firewall configuration) do not allow the interface to emit GRE packets.

Solution: locate the rule that prevents the write, or add a rule to cover it, and retry the tunnel.

buffering out-of-order packet

Symptom: while running pptp, this message appears, which may or may not be associated with any other problem:

log[decaps_gre:pptp_gre.c:397]: buffering out-of-order packet 272 (expecting 271)

Diagnosis: this is a normal situation. Many network links drop or re-order packets as a normal part of their operation. This message informs you that a packet was lost or re-ordered. The TCP network infrastructure above this level will retransmit the lost data.

(out-of-order in this context relates to the sequence of the packets, and should not be confused with the use of the phrase in some locales to warn that public equipment is not operating.)

Solution: if the loss is higher than the physical layer should provide, check the physical layer for problems.

You can also use the link statistics feature of pptp, see the man page for how to obtain and understand the statistics.

2004-02-16

Running pppd (before connection)

pppd cannot load kernel module ppp_generic

Symptom: when starting PPTP Client on Red Hat 7.2 or 7.3, the pppd process cannot locate the appropriate module.

modprobe: modprobe: Can't locate module char-major-108 /usr/sbin/pppd: This system lacks kernel support for PPP. This could be because the PPP kernel module could not be loaded, or because PPP was not included in the kernel configuration.

Diagnosis: the 2.4.0-4 ppp-mppe package adds entries to /etc/modules.conf that work only for Red Hat 6.2.

Solution 1: use the kernelmod instructions which are part of the Red Hat 9.0 HOWTO. This alleviates the problem.

2003-05-02

Solution 2: Edit the /etc/modules.conf file and change the alias char-major-108 ppp to alias char-major-108 ppp_generic.

Couldn't set tty to PPP discipline: Invalid argument

Symptom: the following messages appear before connection is established:

Serial connection established. Couldn't set tty to PPP discipline: Invalid argument Hangup (SIGHUP)

Diagnosis: pppd has failed to change the pty over to run it in PPP mode. This may be because you have no ppp_async module built for your kernel. Most kernels are built with this already, but if you have customised your kernel you may not have built it.

Solution: rebuild your kernel with CONFIG_PPP_ASYNC set. While you are at it, you should set CONFIG_PPP as well, and both should be set to "m" so that they are built as modules. We've found they don't work compiled statically.

2004-02-02

write: warning: Input/output error
Symptom: when using pptp started as a psuedo-tty from within pppd, the following messages appear before connection is established:

write: warning: Input/output error (5) Modem hangup

Diagnosis: pptp is not running at the time pppd writes to the psuedo-tty. This may be because you have no pptp program, or it may have failed. Enablingdebug logging would show just one message, an LCP write, being sent prior to the write warning.

Solution: check that the pptp program is present, check that the --nolaunchpppd option is being used, and check the messages log for messages emitted bypptp.

none of the available passwords would let it use an IP address

Symptom: pppd fails during a connection attempt and issues this message:

The remote system (hostname) is required to authenticate itself but I couldn't find any suitable secret (password) for it to use to do so. (None of the available passwords would let it use an IP address.)

Note the last line. If this is not present, read the required to authenticate entry.

Diagnosis: No IP address listed in chap-secrets file. pptp-command adds entries to the file without an IP address, and the manual page for pppd says that this means no IP address will be considered valid. Not all versions of pppd require this.

Solution: Adjust the chap-secrets file to add an asterisk as the address, which is the fourth field.

Running pppd (during connection)

CHAP authentication failed

The usual cause of this is entering the wrong password. Passwords which contain odd characters, like hash (#) may need to be quoted in the chap-secrets file.

Other causes are:

invalid format for domain and username,
specifying the wrong domain (E=691),
restrictions on logon hours (E=646),
account is disabled (E=647),
account password expired (E=648),
not having dialin permission (E=649),
specifying the wrong password (E=691), (e.g. by not quoting special characters),
using spaces or blanks as part of your password (E=691), (our tests show this doesn't work).

2003-12-15

Often the E=nnn error number above is followed by a R=0 or R=1, which means the server is disallowing or allowing a retry respectively. pppd on Linux generally doesn't use the opportunity to retry. There may also be an opportunity to change the password, but this is not well understood here.

2006-01-24

No dialin permission
Unknown MS-CHAP authentication failure: E=649

Remote message: Unknown authentication failure: E=649

Problem: pppd displays an error:

Remote message: Unknown authentication failure: E=649 R=0 CHAP authentication failed

Diagnosis: error code 649 is ERROR_NO_DIALIN_PERMISSION, the account does not have dialin permission.

Solution: ask the server administrator to give your account dialin permission.

2003-12-15

failed to authenticate ourselves to peer

Symptom: pppd fails during a connection attempt and issues this message:

sent [CHAP Response id=0x0 <...>, name = "domain\\\\username"] rcvd [LCP EchoRep id=0x0 magic=0x15973814] rcvd [CHAP Failure id=0x0 "E=691 R=1 C=... V=3"] Remote message: E=691 R=1 C=... V=3 CHAP authentication failed sent [LCP TermReq id=0x3 "Failed to authenticate ourselves to peer"] rcvd [LCP TermAck id=0x3 "Failed to authenticate ourselves to peer"]

Diagnosis: four slashes have been used instead of two between the domain name and the username. This is a common error, due to the escaping and quoting rules of the shell versus the pppd options file.

Solution: remove two of the slashes.

remote system is required to authenticate itself
Symptom: pppd fails during a connection attempt and issues this message:

The remote system (hostname) is required to authenticate itself but I couldn't find any suitable secret (password) for it to use to do so.

If after this it says that none of the available passwords would let it use an IP address, read the previous entry.

Diagnosis 1: While normally the PPTP Server will require authentication from your client, your pppd configuration files can tell your client to require authentication from the PPTP Server. The message shows there is insufficient information to achieve this, and so pppd stops.

Solution 1: Usually it is not necessary to have the PPTP Server authenticate in this way. Make sure that noauth option is in the options file, or given to pppdvia the command line. Make sure that require-mschap-v2 require-mschap require-chap require-pap require-eap options are not used.

Diagnosis 2: You may have rebuilt the kernel after installing the modules for the PPTP Client. During "make modules_install", you will have overwritten themisc/mppe.o and kernel/drivers/net/ppp_generic.o modules.

Solution 2: reinstall the two modules.

We believe there may be other causes of this error. Please write to the mailing list if this solution does not fix your problem, so that we can work together to improve this HOWTO.

Could not determine local IP address

Problem: connection fails and the logs contain this message:

Could not determine local IP address sent [IPCP TermReq id=0x4 "Could not determine local IP address"]

Diagnosis: pppd has completed IPCP negotiation with the peer (e.g. the PPTP server) and was about to raise the new network interface, but found that neither the peer, the command line, or the hostname gave a valid IP address.

Usually, the peer provides the IP address during IPCP negotiation. You can examine the debug log to determine how this negotiation proceeded.

Solution: choose one:

provide an IP address on the command line, (see man pppd in the section marked OPTIONS, or just add the IP address followed by a colon, e.g. 10.0.0.1:),
change the peer configuration to suggest a local IP address,
ensure that the noipdefault option is not being used, and that the system hostname translates to an IP address.

pppd tries to determine your local IP address using the host name. On systems installed without a hostname, this may fail. So set a hostname using thehostname command, and add the IP address to /etc/hosts. This change may require the restart of other processes.

2004-03-08

LCP: No network protocols running
See below.

LCP: timeout sending Config-Requests

This is a general error condition that is common to a number of causes. It means that pppd did not receive any LCP configuration requests from the peer, or was unable to agree on LCP parameters. Enable debug logging, try the connection again, and look at messages just prior to this message.

There are many causes for the timeout error:

MSCHAP negotiation failed,
no GRE packets were received by the client,
no GRE packets were transmitted by the server,
invalid GRE packets were transmitted by the server,
no GRE packets were transmitted by the client.
invalid GRE packets were transmitted by the client,

Use tcpdump to check the flow of GRE packets.

No GRE received by PPTP Client

sent [LCP ConfReq ...]

rcvd

No GRE transmitted by PPTP Server

Symptom

Diagnosis: PPTP servers will not allow a connection to start from the same IP address that they perceive an active connection on already.

Solution: use alternate PPTP server IP addresses.

Invalid GRE packets transmitted by server

Symptom

rcvd [proto=0x7eff] 7d 23 c0 21 7d 21 7d 21 7d 20 7d 39 7d 22 ...]

Diagnosis: you may be running pppd with the sync option, with a version of the GRE-to-PPP gateway that will recognise sync mode, but the server is returning asynchronous responses.

Solution: turn off sync and try again.

No GRE packets transmitted by client

Symptom: tcpdump shows no GRE packets are being transmitted by the client. strace shows no write() on the GRE socket by the GRE-to-PPP gateway process.

Diagnosis: you may be running pppd with the sync option, which prevents older version of the GRE-to-PPP gateway from forwarding the packets.

Solution: turn off sync and try again.

Symptom: tcpdump shows no GRE packets are being transmitted by the client. However, strace shows a successful write() on the GRE socket by the GRE-to-PPP gateway process.

Diagnosis: your system may have iptables or ipchains rules that prevent GRE transmission. The GRE-to-PPP gateway sends the packets, but they are dropped by the packet filter before being transferred to the interface.

Solution: check the firewall rules, remove or add replacements, and try again. The following iptables rules may be added to allow GRE through eth0. Change eth0 to the name of the interface through which the PPTP Server is contacted.

iptables --insert OUTPUT 1 \ --source 0.0.0.0/0.0.0.0 \ --destination 0.0.0.0/0.0.0.0 \ --jump ACCEPT --protocol gre \ --out-interface eth0 iptables --insert INPUT 1 \ --source 0.0.0.0/0.0.0.0 \ --destination 0.0.0.0/0.0.0.0 \ --jump ACCEPT --protocol gre \ --in-interface eth0

These rules can be refined further to constrain the GRE traffic.

Invalid GRE packets transmitted by client

Symptom

Diagnosis: you may be running pppd with the pty option and the debug option but not the logfd 2 option. This can cause pppd to send the debug messages out the psuedo-tty file descriptor to the GRE-to-PPP gateway process, and then to the PPTP Server. The server refuses to respond once it sees random traffic like this.

Solution: Add the logfd 2 option.

LCP ConfRej
Symptom: you are using PPP-MPPE 2.4.x and logs contain this sequence:

rcvd [LCP ConfReq id=0x0 ] sent [LCP ConfRej id=0x0

See next item below.
LCP ConfRej

No auth is possible

Symptom: you are using PPP 2.4.2 or later and logs contain this sequence:

rcvd [LCP ConfReq id=0x0 ] No auth is possible sent [LCP ConfRej id=0x0

Diagnosis: your pppd is refusing to perform MS-CHAP-V2 authentication. The PPTP Server requires it, and so it terminates the connection. The known causes are:

pppd could not find a matching entry in the chap-secrets file, (see below for causes)
pppd was built without MS-CHAP-V2 support (quite uncommon).

The search in the chap-secrets file uses the name and remotename options given to pppd. The name is usually the authentication domain and username. Theremotename is usually PPTP, or the name of the tunnel.

The chap-secrets file is a series of lines with blank separated fields. The file is searched for a line where:

the first field matches the local name option value (e.g. domain\\username),
the second field matches the remotename option value (e.g. tunnelname or PPTP), and
the fourth field contains a valid IP address or asterisk.

Any spaces or special characters in the local name, password, or remote name must be properly quoted. The hash character (#) in a password is a definite cause of this; add quotes around the password to fix it. See man pppd section AUTHENTICATION for more details.

Solution: fix the chap-secrets file or the pppd options so that they match.

2005-06-02

CCP: timeout sending Config-Requests
The pppd did not complete CCP configuration within the timeout period. Usually caused by a conflict between the client and the PPTP Server. Enable debug logging, try the connection again, and look at messages just prior to this message.
See below for the most likely cause.

CCP ConfNak

Symptom: debug logs contain this sequence:

sent [CCP ConfReq id=0x5] rcvd [CCP ConfNak id=0x5 ] sent [CCP ConfReq id=0x6] rcvd [CCP ConfNak id=0x6 ] sent [CCP ConfReq id=0xa] rcvd [CCP TermReq id=0x3 00 00 02 dc] sent [CCP TermAck id=0x3] sent [LCP EchoReq id=0x1 CCP: timeout sending Config-Requests sent [LCP EchoReq id=0x2 No response to 4 echo-requests Serial link appears to be disconnected. sent [LCP TermReq id=0x3 "Peer not responding"]

Diagnosis: your pppd is refusing to accept MPPE encryption. The PPTP Server requires MPPE, and so it terminates the connection.

Solution: make sure the MPPE module loads successfully. Prove this using the MPPE step in the Fault Tree.

LCP terminated by peer (peer refused to authenticate)
Your pppd could not negotiate authentication. Enable debug logging, try the connection again, and look for rejection packets just prior to this message. Decide what to do based on the rejection packets.
LCP terminated by peer (garbled text)
Your pppd could not negotiate encryption. Enable debug logging, try the connection again, and look for rejection packets just prior to this message. Decide what to do based on the rejection packets.
See the next two sections below for the most likely causes.

EAP Response ... LCP TermReq

Symptom: an LCP TermReq occurs immediately after an EAP Response, as per this example log:

rcvd [EAP Request id=0x0 Identity ] sent [EAP Response id=0x0 Identity ] rcvd [LCP TermReq id=0x3 0e a3 45 cf 00 3c cd 74 00 00 02 89] LCP terminated by peer (^NM-#EM-O^@

Diagnosis: this may be an indication that EAP authentication failed.

Solution: either correct the cause of the authentication failure, or direct the client to refuse EAP authentication by adding refuse-eap to the list of pppdoptions.

2003-05-26

CCP terminated by peer

Compression negotiation has failed. Occurs after a CCP ConfRej. See below for likely cause.

If that doesn't fix it, enable debug logging, try the connection again, and look for rejection packets just prior to this message. Decide what to do based on the rejection packets.

2003-05-26

CCP ConfRej

Symptom: logs contain this sequence:

sent [IPCP ConfReq id=0x1 ] sent [CCP ConfReq id=0x1 ] rcvd [CCP ConfReq id=0x3 ] sent [CCP ConfNak id=0x3 ] rcvd [CCP ConfNak id=0x1 ] sent [CCP ConfReq id=0x2] rcvd [CCP ConfReq id=0x5 ] sent [CCP ConfRej id=0x5 ] rcvd [CCP ConfNak id=0x2 ] sent [CCP ConfReq id=0x3] rcvd [LCP TermReq id=0x6 "#\37777777776U\37777777621\000<..."] LCP terminated by peer (#M-~UM-^Q^@ sent [LCP TermAck id=0x6]

Diagnosis 1: your pppd is refusing to accept the level of MPPE encryption required by the PPTP Server. The PPTP Server insists on that level, and so it terminates the connection.

Solution 1: make sure the require-mppe option is provided to the pppd command, such as in the options file. For versions of pppd prior to and including 2.4.0, provide the options mppe-40, mppe-128 and mppe-stateless. See also Why are the pppd options different?.

Make sure the MPPE module loads successfully. Prove this using the MPPE step in the Fault Tree.

Diagnosis 2: You may have rebuilt the kernel after installing the modules for the PPTP Client. During "make modules_install", you will have overwritten themisc/mppe.o and kernel/drivers/net/ppp_generic.o modules.

Solution 2: reinstall the two modules.

CCP: No compression negotiated
See below.

CCP ConfRej

Symptom: debug logs contain this sequence:

sent [CCP ConfReq id=0x1 ] rcvd [CCP ConfRej id=0x1 ] sent [CCP ConfReq id=0x2] sent [CCP ConfReq id=0x2] rcvd [CCP TermAck id=0x2] sent [CCP TermReq id=0x3"No compression negotiated"] rcvd [CCP TermAck id=0x3]

Diagnosis: your pppd is suggesting only deflate and bsdcomp compression options, and not MPPE. The PPTP Server rejects the suggestions and disconnects.

Solution: make sure the require-mppe option is provided to the pppd command, such as in the options file. For versions of pppd prior to and including 2.4.0, provide the options mppe-40, mppe-128 and mppe-stateless. See also Why are the pppd options different?. Make sure the nobsdcomp and nodeflate options are provided, so that pppd does not suggest them.

MPPE required, but MS-CHAP[v2] auth not performed.

Symptom: logs contain this message:

MPPE required, but MS-CHAP[v2] auth not performed.

Diagnosis: you have given pppd the option require-mppe which forces the use of encryption, but the authentication phase did not use MS-CHAP[v2], it used something else. MPPE requires the use of MS-CHAP[v2] for establishing initial encryption keys. pppd terminates once it detects this conflict.

Solution: either fix the authentication or remove require-mppe.

To find out how authentication happens, enable debug logging, try the connection again to determine what method the peer is offering for authentication. Then configure pppd to refuse that method.

Or, add the following pppd options:

refuse-eap
refuse-pap
refuse-chap
refuse-mschap

These options configure pppd to refuse to authenticate using certain protocols. As a result, the peer will attempt other protocols, hopefully MS-CHAP[v2]. Do not use require-mschap-v2 because this asks pppd to authenticate the peer, a reversal of what is normally done.

2006-03-27

MPPE required but peer refused

Symptom 1: logs contain this sequence:

LCP terminated by peer (MPPE required but peer refused)

Symptom 2: debug logs contain this sequence:

sent [CCP ConfReq id=0x1] rcvd [CCP ConfReq id=0x1 ] rcvd [CCP ConfAck id=0x1] sent [CCP ConfRej id=0x1 ] rcvd [LCP TermReq id=0x2 "MPPE required but peer refused"]

Diagnosis: the local pppd is refusing to accept the level of MPPE encryption required by the peer. The peer insists on that level, and so it terminates the connection.

In the case above, the local pppd has proposed no encryption or compression, but the peer has requested stateless 128-bit encryption. The local pppd rejects the proposal from the peer.

Solution: if you are using the GUI, select the tunnel, click on on the Encryption tab, turn on Require Microsoft Point-to-Point Encryption (MPPE), and Update, and try to Start the tunnel again.

Otherwise, make sure the require-mppe option is provided to the pppd command, such as in the options file or the command line.

2003-06-17

MPPE required but peer negotiation failed

Symptom: require-mppe-128 option is set, and debug logs contain this sequence:

sent [CCP ConfReq id=0x1 ] rcvd [CCP ConfReq id=0x4 ] MPPE required but peer negotiation failed sent [LCP TermReq id=0x4 "MPPE required but peer negotiation failed"]

with the essential component being the immediate termination by the local host on receipt of a CCP ConfReq that has the encryption bits turned off (-M -S -L).

Diagnosis: this is a defect of pppd on your system. It is terminating the connection on the basis that the peer started to suggest no encryption. Your pppd is not first negotiating to achieve encryption. The version of pppd you are using takes the require-mppe-128 option pedantically; refusing to connect if the peer is configured to allow no encryption, even if the peer may allow encryption after negotiation.

2005-01-19

Solution: you may fix this by (either);

using a later version of pppd that is not so pedantic, and will negotiate further to achieve encryption (a fix was made in revision 1.49 of file pppd/ccp.c in PPP CVS as the solution to closed Debian bug 294232 but is not yet released by the PPP project ... so you can upgrade to PPP CVS or apply the patch in the bug report), or

2006-03-09

removing the require-mppe-128 option from the file /etc/ppp/options.pptp and any other options given to pppd, if you are content with not using encryption (which can be risky),
configuring the peer to require encryption.

If the peer is a server is on the public internet, you may wish to warn the administrator that it is not set to require encryption, and so tunnels may be established in the clear, which is an information security risk. If they change the configuration to require encryption, this seems to fix this problem, because the initial negotiation attempt includes MPPE.

2005-01-19

(If the peer is Microsoft Windows 2000 acting as a server, check that the No Encryption option in Remote Access Policies is disabled. Rob Gamble provided us with instructions to fix this.)

2003-08-12

Symptom: debug logs contain this sequence:

Disabling 40-bit MPPE; MS-CHAP LM not supported sent [CCP ConfReq id=0x1 ] rcvd [CCP ConfNak id=0x1 ] MPPE required but peer negotiation failed sent [LCP TermReq id=0x3 "MPPE required but peer negotiation failed"]

Diagnosis: You have directed the local pppd to require MPPE, but the negotiation with the peer failed to find a compatible encryption level and method.

In the case above, the local pppd has proposed stateless 128-bit encryption and compression, but the peer has requested stateless 40-bit encryption and no compression. The local pppd was built without 40-bit MPPE support, or 40-bit MPPE was disabled, and so it decided it could not proceed.

Depending on the debug messages that appear prior to the "MPPE required but peer negotiation failed" message, there may be other causes. Please write to the mailing list if you've found one that we haven't documented, and include the debug messages.

Solution: Rebuild pppd for 40-bit MPPE support, enable 40-bit MPPE support, or change the peer to accept 128-bit MPPE.

(If the peer is Microsoft Windows XP acting as a client, change properties for the VPN connection, select the security tab, then the settings button next to advanced. Under Data encryption, select "Maximum strength encryption". Contributed by Bob Elzer.)

2003-06-16

(If the peer is Microsoft Windows 2000 acting as a server, try adding the pppd options nomppe-stateful, nobsdcomp and novj. Contributed by Andrew Cilia.)

2003-10-13

LCP TermReq id=0x3 "MPPE required but not available"

Symptom: debug logs contain this sequence:

MPPE required, but kernel has no support. sent [LCP TermReq id=0x3 "MPPE required but not available"]

See below.

2003-06-05

MPPE required, but kernel has no support.

Symptom: logs contain this sequence:

MPPE required, but kernel has no support.

Diagnosis: either the kernel has no MPPE support, or this version of pppd is incompatible with the MPPE kernel module version you used. The most likely cause is using PPP 2.4.2 or later on a kernel that has an MPPE module built for PPP-MPPE 2.4.0 or 2.4.1.

For a bit more history on this, see also Why are the pppd options different?

Solution: Ensure you have MPPE support in the kernel. Prove this using the MPPE in kernel step in the Fault Tree.

Ensure the versions of PPP and PPP's MPPE kernel support match.

To identify the version of PPP, use the command:

# pppd --version

Identifying the version of PPP's MPPE kernel module is not as straightforward. It is best to know where it came from originally. Linux kernel 2.6.15 or later include the module already. If you've used a patch, use the command:

# modinfo ppp_mppe

to find whether the module information says the license is "BSD without advertisement clause". If it is, then it is most likely the PPP 2.4.2 or later module.

If the module name is mppe.o, then it is most likely the PPP-MPPE 2.4.0 module.

If the kernel package or module package significantly predates the release of the version of PPP that you are running, then a version mismatch is even more likely.

2003-06-05

Received bad configure-ack

Problem: the error message "Received bad configure-ack" appears as a result of starting a connection.

Diagnosis: PPP has received a configuration acknowledgement from the peer that differs substantially from a request it made. This indicates a faulty peer implementation.

Solution: enable debug mode, start the tunnel manually, and look for the cause of the problem in the output. Check the rest of this document.

See below for one known cause.

2003-07-09

LCP ConfNak id=0x1

Problem: the peer persists in refusing an MRU value other than 1500, eventually sending a bad configure ack, as per the following log:

rcvd [LCP ConfNak id=0x1 ] sent [LCP ConfReq id=0x2 ] rcvd [LCP ConfNak id=0x2 ] sent [LCP ConfReq id=0x3 ] rcvd [LCP ConfNak id=0x3 ] sent [LCP ConfReq id=0x4 ] rcvd [LCP ConfNak id=0x4 ] sent [LCP ConfReq id=0x5 ] rcvd [LCP ConfNak id=0x5 ] sent [LCP ConfReq id=0x6 ] rcvd [LCP ConfRej id=0x6 ] sent [LCP ConfReq id=0x7] rcvd [LCP ConfAck id=0x7 ] Received bad configure-ack: 02 06 00 00 00 00 05 06 07 b4 d8 db 07 02 08 02

Diagnosis: this happens with certain peers if the mru option is used to attempt to restrict the maximum receive unit (MRU) size.

Solution: remove the mru option. MRU is separate to MTU, and MTU restriction for ICMP blocked PPTP servers is usually sufficient.

2003-07-09

Running pppd (after connection)

Unsupported protocol 0x2145 received

Problem: the PPTP Server is trying to use Microsoft Point-to-Point Compression (MPPC), and your local pppd does not support it. Most frequently seen with Watchguard Firebox product.

Solution 1: add nopcomp to the options. (noaccomp may also be required, though for some people it stops it working.)

Solution 2: turn off MPPC at the PPTP Server.

Solution 3: add MPPC support to your system, if it is available.

MPPC is a patent-encumbered compression method.

References:

Cisco's description of MPPC, showing the protocol code.
Mail on [pptp-server] mailing list saying that you don't need MPPC anyway, and nobody has written it for Linux. [link no longer valid]
FreeBSD supports it, somehow. However investigations by Frank show the code is not present.
A book mentions ppp-mppc in contents listing, implying existence.
Mail saying that MPPC would need licensing from STAC Electronics.

The ppp package README confirms the above, where it says:

Compression methods. ******************** This package supports two packet compression methods: Deflate and BSD-Compress. Other compression methods which are in common use include Predictor, LZS, and MPPC. These methods are not supported for two reasons - they are patent-encumbered, and they cause some packets to expand slightly, which pppd doesn't currently allow for. BSD-Compress is also patent-encumbered (its inclusion in this package can be considered a historical anomaly :-) but it doesn't ever expand packets. Neither does Deflate, which uses the same algorithm as gzip.

Jan Dubiec's implementation of MPPC, which may be a violation of the patent but we've not checked.

Protocol-Reject for unsupported protocol 0x????
See below.

LCP ProtRej id=0x??

Symptom: on kernel 2.6.15 or later, Gentoo pppd created with USE mppe-mppc emerge flags, connection is established, but after MPPE is negotiated no data transfer happens, and the pppd log shows "Protocol-Reject for unsupported protocol".

Diagnosis: the MPPC patch to pppd is not compatible with kernel 2.6.15 MPPE kernel module.

Solution: either downgrade to the previous kernel or re-emerge ppp without the mppe-mppc flags.

2006-01-23

Symptom: connection is established, but after MPPE is negotiated no data transfer happens, and the debug logs contain this sequence:

rcvd [LCP ProtRej id=0x70 59 ae 22 41 d5 15 51 fc 50 3a 4b 21 ...] rcvd [LCP ProtRej id=0x71 b5 a7 dc 7d 99 fd eb ec 92 5e 0b b6 ...] rcvd [LCP ProtRej id=0x72 e9 62 fb 15 c1 b5 e0 b3 92 22 46 1e ...] rcvd [LCP ProtRej id=0x73 19 3d 51 49 25 4f 25 f9 98 0d 1f 70 ...] rcvd [LCP ProtRej id=0x74 cc 09 4e a5 62 59 92 cf 88 8d 4b 99 ...]

The important pattern appears to be the incrementing first byte.

Diagnosis: the PPTP Server has negotiated 40-bit MPPE, but the client has negotiated 128-bit MPPE. The protocol reject messages are triggered by the pppdreading the improperly decoded data stream. Cause of this situation is not known, but it may be due to the PPTP Server being configured for 40-bit encryption only.

Solution 1: add nomppe-128 to the options given to pppd.

Solution 2: if using PPP-MPPE 2.4.1 on Mandrake, ensure mppe-stateless is included in the options given to pppd.

2003-10-14

Connection closes after 60 seconds
Symptom: logs contain this sequence:

bad bytes thrown away Outgoing call established [60 second delay] Closing PPTP connection

Diagnosis: the PPTP Server is not conforming to RFC2637, which states that the reserved0 field in the header MUST be zero. It was fixed in 1.1.0-1, thanks to Rein Klazes.

Solution: upgrade to pptp-linux-1.1.0-1 or later.
RTNETLINK answers: File exists
huge transmit data counters

LCP EchoReq without LCP EchoRep

Symptom: connection is established but no data transfer happens, ifconfig shows large amounts of data transmitted on PPTP tunnel, tcpdump shows many transmitted packets, the connection is closed after one minute, and debug logs contain this sequence:

rcvd [LCP EchoReq id=0x1 sent [LCP EchoRep id=0x1 sent [LCP EchoReq id=0x1 rcvd [LCP EchoReq id=0x2 sent [LCP EchoRep id=0x2 sent [LCP EchoReq id=0x2

which indicates that echo requests from the server are being received by the client, which issues an echo reply, but that echo requests from the client are not generating echo replies from the server.

Diagnosis: the route to the PPTP Server has changed to include the tunnel itself, and packets are being looped. Packets sent through the VPN are being encapsulated in PPP over GRE, and then sent through the same interface again.

See our diagram that explains this further. See our Routing HOWTO for more information about routing.

Solution: examine the routing table using netstat -rn before and after the tunnel becomes active. Determine why the route to the PPTP Server is via the tunnel interface. We list some possible reasons and actions that can be taken:

Possible Reason Action

1. the defaultroute option was used, causing pppd to add a new default route that overrides the existing default route that was used to initiate the tunnel. remove defaultroute from the options given to pppd, and use other means to provide routes through the tunnel interface.

2. distribution specific or local interface-up scripts changed the route. change or remove the scripts so that they do not change the route in this manner.

3. the PPTP Server may have failed to provide an IP address, causing the new interface to have the same address as the default address on your host (compare "local IP address" in the logs, or the address shown by "ifconfig ppp0" with the address of your main network interface). add the noipdefault option.

4. the PPTP Server may have given its own IP address for the new interface (compare "remote IP address" in the debug logs with the IP address you give topptp).

try one of the following:

change the point-to-point IP address of the newly created ppp interface, using an ip-up or ip-pre-up script, for example;

#!/bin/sh # $1: interface-name # $4: local-IP-address # delete the assigned address from the network device ip addr del $4 dev $1 # add back the assigned address along with a replacement peer address ip addr add $4 peer 10.0.0.1/32 dev $1 # add a default route, remove if not wanted route add default $1

change the point-to-point IP address of the newly created ppp interface, using ifconfig, for example;

ifconfig ppp0 pointopoint 10.0.1.1

where 10.0.1.1 is the address to be adopted, see internal address for how to determine this.
add a static route to the PPTP Server via your usual default gateway, for example;

route add -host x.x.x.x/32 gw y.y.y.y dev nnn0

where x.x.x.x is the IP address of the PPTP Server, y.y.y.y is the IP address of your usual default gateway, and nnn0 is the name of the network interface through which the gateway is contacted.
request a more appropriate address by adding an option such as :10.0.1.1, where 10.0.1.1 is the address to be adopted, (the PPTP server may be configured to refuse the request, or may not be capable of it)
use the iptables and ip commands to direct the tunnel packets away from the tunnel interface, see our Routing HOWTO for more detail,
ask the PPTP Server administrator to change the configuration to use another remote address.

2004-04-06

Not enough space to encrypt packet
Problem: following message appears in pppd logs

Not enough space to encrypt packet: 1004<1004+4!

Solution: patch ppp_generic.c using the patches in this project's CVS repository.

The patches are in mppe/kernel/kernel, and are ppp_generic.ccp_max_option_length.patch and ppp_generic.header_length.patch.

Carsten Grammes found that the SuSE 8 kernel (2.4.18-4GB) has MPPE support, but shows this problem. The patches above solved the problem. [2002-08-23]

Connections via tunnel freeze

Are your connections from the PPTP Client or from another machine on your network?

Problem: TCP connections via the tunnel freeze once they attempt to transfer large amounts of data.

Diagnosis: path MTU discovery may be failing due to ICMP blocking by hosts after the PPTP server.

Solution: manually restrict the MTU on the interface, by adding mtu 1404 or some smaller value as an option to the pppd program, either in the peers file for the tunnel, in the options file, or on the command line. You can also restrict the MTU on the interface after the tunnel has connected, using a command likeifconfig ppp1 mtu 1400.

The effect is that new TCP connections from your host will use an maximum segment size (MSS) that is lower. This may prevent path MTU discovery from being necessary.

2004-02-09

Problem: TCP connections using the PPTP Client host as a hop in the route (such as via normal routing, NAT or IP masquerading) freeze once they attempt to transfer large amounts of data.

Diagnosis: path MTU discovery may not be working, due to hosts on the route refusing to forward ICMP fragmentation needed responses.

Solution: if using Linux 2.2, reduce the MTU on all hosts using the PPTP Client host as their route, e.g. ifconfig eth0 mtu 1400. If using Linux 2.4 or later, add the following iptables rule:

iptables --append FORWARD --protocol tcp \ --tcp-flags SYN,RST SYN --jump TCPMSS --clamp-mss-to-pmtu

For more information, see section 15.7, Circumventing Path MTU Discovery issues with MSS Clamping (for ADSL, cable, PPPoE & PPtP users) in the Linux Advanced Routing & Traffic Control HOWTO.

Connections via tunnel fail or timeout
Problem: tunnel connects, ping fails to other end of tunnel, and transmit packet and byte counts as shown by ifconfig for the tunnel interface are rapidly increasing.
Diagnosis: an IP loop may exist.

Solution: see the IP loop section.

Problem: tunnel connects, ping fails to other end of tunnel, and CPU load is very high.

Diagnosis: an IP loop may exist.

Solution: see the IP loop section.

Problem: tunnel connects, ping works to other end of the tunnel (remote IP address as shown in debug log), but cannot ping beyond that point, and connections to hosts at the other end fail or timeout.

Solution: this is a routing problem, not a tunnel problem. Check out the PPTP Client Routing HOWTO.
Terminating on signal 2
Problem: when stopping a tunnel, there's an endless stream of "Terminating on signal 2" messages.
Diagnosis: this is a reported problem in PPP 2.4.2 with a known cause.

Solution: either undo the change in the source or downgrade to a CVS snapshot of PPP dated 20040102.

Loading kernel modules

init_module: File exists

Problem: when attempting to manually install the MPPE module, using modprobe ppp_mppe (instead of modprobe ppp-compress-18 as we suggest), the following error is displayed:

init_module: File exists

Diagnosis: you may have an old alias ppp-compress-18 mppe line in your /etc/modules file from a previous installation, and the mppe.o module may already be loaded.

Solution: remove the line, it is no longer needed with PPP versions 2.4.2 or later. Reboot, and try again. If rebooting is costly, ensure the module is removed, and try depmod -a.

2003-10-24

Fault Tree

Ping PPTP Server
Prove that you can bounce ICMP echo request packets off the PPTP Server. If you can, this shows you have a network connection to it. If you can't, it doesn't prove anything, because it could be firewalled.

# ping pptpserver
Traceroute to PPTP Server
Prove that you can trace the route to the PPTP Server. If you can, this shows you have a network connection to it. If you can't, again it doesn't prove anything, because it could be firewalled. However, only you can tell, given your knowledge of the network near you.

# traceroute pptpserver
Connect to port 1723 on PPTP Server
Prove that you can connect to the PPTP Server on the TCP/IP port used for call management. If you can, this shows you have half the network connectivity you need. If you can't, you must fix the problem.

# telnet pptpserver 1723

Check GRE Works

Prove that you can exchange GRE packets between the PPTP Server and the client. To do this, run a packet tracing tool such as tcpdump at the client while starting the tunnel. You should see a connection to port 1723, followed by GRE packets in both directions. If you are new to tcpdump, we have instructions.

For diagnosing the point at which GRE is lost in a network path;

hping2 can do GRE traceroute [http://www.hping.org/], and
a version of the traceroute program which uses GRE [http://lists.debian.org/debian-isp/2001/debian-isp-200103/msg00175.html]

Note: these days with the profusion of cheap consumer-grade NAT routers and gateways, hping2 and GRE traceroute do not work as well as one would like. This is because most NAT routers use stateful inspection of the PPTP control connection to determine how and when to forward the GRE packets. Concentrate on block-box analysis using tcpdump at the end points you have access to.

2006-04-12

Common GRE blockages are as follows:

Firewalls and Gateways
Hosts between your client and the server through which GRE must pass may be configured to block GRE. Using the GRE traceroute programs above you may be able to identify the host that is causing the block.
Local Filtering Rules
The client may be configured to block GRE packets as they arrive, or before they depart. Check your iptables or ipchains configuration.
Simultaneous Tunnels via NAT Gateway
If you have a NAT gateway, such as a DSL router, that presents one IP address to the network on which the PPTP Server is contacted, then only one PPTP connection can be active at once. The PPTP Server will only accept one.

Attempting to start a second tunnel to another IP address may also fail if the NAT software cannot differentiate the two connections. This may cause the first connection to fail.

PPTP Server Misconfiguration
If the PPTP Server fails to start pppd because of a syntax error in the options file or command line, the effect mimics a total loss of GRE packets from the server end. Check the server logs carefully. Start pppd manually at the server to test the options.

Check MPPE Support
MPPE support is required if you wish to connect to a PPTP Server such as Microsoft Windows VPN Server. MPPE is built as a Linux kernel module, as part of PPP 2.4.2 or later, and as a patch to the PPP 2.4.0.
Both of the following tests must pass for MPPE support to function.

Check MPPE in kernel Support

Make sure the MPPE module can be loaded:

# modprobe ppp-compress-18

If this module loads without error, then all is well with it. If errors are generated, you must find the cause and fix it. There are numerous causes of a failure to load. Some of the causes are;

depmod -a was not run after loading a kernel-mppe rpm,
the MPPE module cannot be found in the appropriate /lib/modules directory,
the MPPE module that was found cannot be loaded because of version conflicts,

an old mppe.o file was left around after an upgrade that provided an ppp_mppe.o file (which results in "init_module: File exists" error if the mppe.o module is loaded somehow),

2003-08-01

the ppp_generic module cannot activate the MPPE module when it finds it needs it, because you are using PPP-MPPE 2.4.0 and the /etc/modules.conf file does not have an entry for alias ppp-compress-18 mppe,
the PPP modules were compiled into the kernel statically (they must be modules for MPPE to work as a module),
the ppp_async module cannot be loaded (although pptp does not use a serial port, the ppp_async module is required for data transfer with the psuedo-tty device).

Check MPPE in pppd Support
Make sure the pppd program contains MPPE support by checking for option keywords in the file. If it contains MPPE options, then it has MPPE support. If it has no MPPE options, you must obtain or build an MPPE capable version.

# strings `which pppd`|grep -i mppe|wc --lines

For a pppd without MPPE support, the number displayed is zero. For an MPPE capable pppd, the number is about 38, but may vary.

Why are the pppd options different?

PPTP Client depends on PPP. See our diagrams for why. PPP needs MPPE support to interoperate with certain PPTP servers.

There are three PPP MPPE versions, and their history is shown in the graph below:

the earlier one contains code licensed under the OpenSSL license, and was independent of the PPP project; it is known as PPP-MPPE 2.4.0. (thanks to those who achieved this!) [red]
the later one contains code licensed using the BSD license; is part of the PPP project; and is known as PPP 2.4.2 or later. [green]
Jan Dubiec's patches to add MPPC support. [blue]

PPP History Graph

There are two parts to the PPP MPPE support, for each version. One part is in the kernel, and the other part is in the pppd program. These two parts must be the same general version. If they are mixed, the result can be that the pppd program reports the kernel has no support.

Comparing the two versions in detail:

PPP-MPPE 2.4.0

no further development?
no response to problems
has known problems such as kernel panics
OpenSSL license directly conflicts with kernel license
when loaded, does not indicate a license conflict
requires /etc/modules.conf changes
module file name mppe.o (or ppp_mppe.o)
+mppe-128 (inconsistent with existing option names)
mppe-stateless
require-chapms-v2 (incorrect protocol name)

PPP 2.4.2 and later

ongoing development by PPP project
active response to problems by developers
has no known problems at this time (stay tuned)
BSD license does not conflict (as much) with kernel license
when loaded, indicates a license conflict
requires no /etc/modules.conf changes
module file name ppp_mppe.o
require-mppe-128
nomppe-stateful
require-mschap-v2

The two versions of pppd have different command line options.

If you are upgrading from the old PPP-MPPE 2.4.0 package, change /etc/ppp/options.pptp, and any existing tunnels in /etc/ppp/peers, to adopt correct naming for pppdoptions relating to MPPE support.

The following table compares the options between the versions.

PPP-MPPE 2.4.0 option	PPP 2.4.2 option	Explanation
mppe-40	require-mppe	require-mppe requires the use of MPPE, disabling all other compression types, and enabling both 40-bit and 128-bit encryption. It is then up to the server what level of encryption is adopted. require-mppe-40 and require-mppe-128 are like require-mppe but use 40-bit and 128-bit encryption respectively, rather than allowing the server to choose.
mppe-128	require-mppe
mppe-stateless	nomppe-stateful	Stateless is now the default, you'd have to use mppe-stateful to turn it off.
require-chapms-v2	refuse-pap refuse-chap refuse-mschap refuse-eap	A client cannot require a method of authentication of itself, but it can refuse a method offered. The "require" forms of these options are intended for use by servers, and if used on a client will force authentication of the server by the client, which will generally fail.

The option naming used previously on the PPTP Client project was for an unofficial MPPE patch to PPP. Since then, the PPP project has derived their own naming that is consistent with other pppd options.

What are those CCP MPPE bitmasks?

PPP negotiates MPPE with the PPTP Server using the Compression Control Protocol (CCP). When using debug logs, pppd decodes the CCP packets. How this is done depends on the version:

in PPP 2.4.2 the packets are decoded fully. Each bit is explained.
in PPP-MPPE 2.4.0 the packets are decoded partially, as a series of numbers, four bytes in hexadecimal.

The following table describes the bits and their meanings:

PPP-MPPE 2.4.0	PPP 2.4.2	Meaning	Explanation
`0x01000000`	`+H`	Stateless	use stateless encryption (less vulnerable to packet loss).
`0x00000080`	`+M`	56-bit	use 56-bit key lengths for encryption (not supported).
`0x00000040`	`+S`	128-bit	use 128-bit key lengths for encryption (less easy to decrypt than 40-bit).
`0x00000020`	`+L`	40-bit	use 40-bit key lengths for encryption (more easy to decrypt than 128-bit).
`0x00000010`	`+D`	Obsolete	obsolete, usage unknown.
`0x00000001`	`+C`	Compression	use compression, see more about MPPC.

The values in the PPP-MPPE 2.4.0 column must be logically ORed. So, if you see a message this shows that the PPTP Server is prepared to support any of the above encryption types. Your system running pppd will likely respond with which shows that it will not support MPPC, or 56-bit keys, but will support stateless 128-bit or 40-bit encryption.

Wanted: what the various PPTP Servers out there initially propose or will settle on given specific configuration options. We plan to build a list, to make it easier to understand why certain PPTP Servers are giving trouble.

What does ConfReq, ConfAck, ConfNak, and ConfRej mean?

ConfReq Proposal	These options and values are desired.
ConfAck Acceptance	These options and values are acceptable. The ConfAck reply will contain the options and values.
ConfNak Counter-proposal	All the options are recognised by the peer, but some of the values in the options are unacceptable. The ConfNak reply will contain the options that were unacceptable, but with values that are acceptable.
ConfRej Rejection	The options are not recognised or not acceptable for negotiation by the peer (e.g. because the remote system is configured to not allow negotiation). The ConfRej reply will contain only the options that are unacceptable. On receipt of a ConfRej, the local system must not include the options in any following ConfReq.

As James Carlson wrote to the linux-ppp mailing list:

How to use tcpdump?

tcpdump can be used to capture the packets exchanged between the PPTP Client and the PPTP Server. By comparing the packets with what should be happening, you may determine what the cause of a problem might be.

Give to tcpdump the name of the network interface that connects to the PPTP Server, which for dial-up users would be ppp0, and for ADSL users eth0. Then, in another window or console, start the tunnel.

Start tcpdump in one window: Then run pppd in the other window:

# tcpdump -i eth0

# pppd call tunnel

The tcpdump command should show you the packets as they are received or transmitted. Press Control/C when you do not need to capture any more packets.

You should see a connection to port 1723, followed by GRE packets in both directions. If you can see this, then you have full network connectivity. If you can't, you must find the problem.

Note: if you get an error:

tcpdump: pcap_loop: read: Network is down

then you may be using tcpdump on the wrong interface. Use ifconfig to list the available interfaces and choose the one through which your client must contact the server. See our diagrams if you're still confused.

The above technique is useful for quick checking, but for detailed analysis a binary tcpdump is required.

Security Warning

Internet addresses of your client and server, usernames and passwords are included in a binary tcpdump. This information may allow someone to gain equivalent access to protected networks. If you do not want to give away this information, convert it to text and remove it before sending the log to someone else.

If you have been asked to capture a complete tcpdump packet trace, for analysis by someone else, you should:

add -w file to tell it to save the packets to the file file,
add -s 0 to capture all of each packet,
and add tcp port 1723 or proto 47 to keep only the PPTP packets, if the client is performing other network traffic at the time.

For example:

# tcpdump -i eth0 -w my.tcpdump -s 0 tcp port 1723 or proto 47

Again, once the packets have been collected, use Control/C to stop the tcpdump process. The file containing the packets can then be e-mailed or analysed.

You may analyse it using ethereal.

# ethereal my.tcpdump

Note: when using ethereal, clicking on a byte in the hex dump will highlight the field name of the data in the packet, and vice versa. You may also analyse it usingtcpdump:

# tcpdump -n -r my.tcpdump > my.tcpdump.txt

This converts it to text, saving the output into a file my.tcpdump.txt. This often hides the username and password. You may wish to globally substitute the IP addresses. Check your results to ensure your security.

2003-10-21

How to enable debug logging?

Add the options debug dump to the pppd command line or options file, then retry the connection. Further information is below. Enabling debug logging is necessary to determine the cause of certain problems. It also gives more information as to why an event happened.

Security Warning

Usernames and passwords from your chap-secrets file may be included in the debug log if you are using the old ppp-mppe package. If you do not want to give away this information, remove it before sending the log to someone else.

How you enable debug logging depends on the method you use to start the tunnel.

usual command enabling debug logging

pptpconfig

click on the tunnel, click on Miscellaneous, click on Enable connection debugging facilities, click on Update, click on Start, examine the output.

Or, if the problem is occuring after a successful connection report:

pppd call tunnel logfd 2 nodetach debug dump

where tunnel is the name of the tunnel you created using the GUI. This command is similar to what the GUI uses to start the tunnel, except for the change to the logfd and nodetach.

pptp-php-gtk

pptp-command start

start the tunnel manually by typing:

pppd pty 'pptp server --nolaunchpppd' call tunnel debug dump logfd 2 nodetach

Where server is the IP address or host name of the PPTP Server, and tunnel is the name of the /etc/ppp/peers entry thatpptp-command created for you.

pon tunnel

add

debug dump logfd 2 nodetach

to the end of the command

pptp ip call tunnel

pppd pty 'pptp ip --nolaunchpppd' call tunnel

The dump phrase includes in the debug log each option given to pppd. This is very useful for others who are trying to help you with a problem.

The logfd 2 nodetach phrase is necessary to prevent debug messages from being sent to the PPTP Server, which may confuse it.

To ease collection of the debug log, use the script command to record the output. For example:

# script test.log # pon tunnel debug dump logfd 2 nodetach

After the command exits, type Control/D or exit and the test.log file will contain a complete log of the session since the script command.

How to enable pptpd debug logging via syslogd?

For users of pptpd, the PPTP server program:

add the keywords debug dump to the /etc/ppp/options.pptpd or /etc/ppp/pptpd-options file, (this is an option for pppd, so there is no need to restart pptpd, the next connection will use the new keywords),
test that syslogd is reporting debug class messages, using the logger command:

# logger -p daemon.debug some unique test message

You should see some unique test message added to a log file in the /var/log directory. If no output appears edit /etc/syslogd.conf and add a debug entry, such as:
1. add the debug entry:
  
  # PPTP debug logging *.debug;mail.none /var/log/debug
2. touch /var/log/debug
3. restart syslogd:
  
  /etc/init.d/sysklogd reload
Note: this is usually needed on Red Hat derived distributions, because debug logging is disabled.
retry the tunnel, and examine the debug log file,
remove debug once you've fixed the problem, as the logs may cost a lot of disk space and performance.

Derived from a post by Peter Mueller.

How to start a tunnel on demand?

The tunnel can be started in a way that will wait for the first packet to be sent before it establishes the connection to the server. This is called "demand" mode. See our diagram for how it works.

Demand mode is handled by PPP, not by PPTP Client. You must start the tunnel using the pppd command rather than pptp. To enable demand mode, add thedemand option to the pppd command, or the /etc/ppp/peers/tunnel file.

If PPP complains that a connect script is required (versions prior to about 2003-07-01 do this) then add the option connect /bin/true.

If you normally have to define specific routes to have the tunnel work to your satisfaction, you will have to define these routes once the PPP interface for the tunnel is created, even though the tunnel is not yet connected. Otherwise, packets that should start the tunnel will be sent out the normal interface instead of the tunnel interface.

The persist option can also be used. This causes the tunnel to be retried if it disconnects. Also check the maxfail option, as the default (10) usually causes the tunnel to eventually stop. Use 0 to say that it should never give up, but remember that this could cause huge amounts of data flow over a long time if the tunnel ever fails in a way that causes PPP to keep trying.

The pptpconfig GUI cannot be used for demand mode, as of 2003-07-30, because it does not set up the routes before starting the pppd process, and it does not show the log of the connection attempt until it succeeds. However, despite these restrictions, if you wish to try it, type demand in the Options for pppd field on theMiscellanous tab, then start the tunnel.

2003-07-30

Known Working Log

The following log shows what might normally be expected to appear for a successful connection from a Debian GNU/Linux (potato) client to a Microsoft Windows NT VPN Server. Use this for comparison against your log. The debug option has been supplied to pppd.

Note: this was last updated for PPP-MPPE 2.4.1, which had debugging code for determining where the username and password information was obtained from, and used the old style of MPPE option reporting. PPP 2.4.2 and later generates slightly different output.

# pon tunnel Using interface ppp1 Connect: ppp1 <--> /dev/pts/1 Looking for secret in /etc/ppp/chap-secrets for client domain\username server PPTP Got client domain\username Got server PPTP Got secret PPTP Got client password sent [LCP ConfReq id=0x1 ] rcvd [LCP ConfReq id=0x0 ] sent [LCP ConfAck id=0x0 ] rcvd [LCP ConfNak id=0x1 ] sent [LCP ConfReq id=0x2 ] rcvd [LCP ConfAck id=0x2 ] sent [LCP EchoReq id=0x0 magic=0x5d4790f] rcvd [CHAP Challenge id=0xf4 <13b0a50a64cb40e5e2afbb47186f8255>, name = ""] Looking for secret in /etc/ppp/chap-secrets for client domain\username server PPTP Got client domain\username Got server PPTP Got secret PPTP Got client password sent [CHAP Response id=0xf4 , name = "domain\\username"] rcvd [LCP EchoRep id=0x0 magic=0x6fe7] sent [CHAP Response id=0xf4 , name = "domain\\username"] rcvd [CHAP Success id=0xf4 "S=B8C96D7EC7960C2EC2C096D5C5256C711D435C67"] Remote message: S=B8C96D7EC7960C2EC2C096D5C5256C711D435C67 sent [IPCP ConfReq id=0x1 ] sent [CCP ConfReq id=0x1 ] rcvd [CCP ConfReq id=0x1 ] sent [CCP ConfNak id=0x1 ] rcvd [IPCP ConfReq id=0x2 ] sent [IPCP ConfAck id=0x2 ] rcvd [CHAP Success id=0xf4 "S=B8C96D7EC7960C2EC2C096D5C5256C711D435C67"] rcvd [IPCP ConfRej id=0x1 ] sent [IPCP ConfReq id=0x2 ] rcvd [CCP ConfNak id=0x1 ] sent [CCP ConfReq id=0x2 ] rcvd [CCP ConfReq id=0x3 ] sent [CCP ConfAck id=0x3 ] rcvd [IPCP ConfNak id=0x2 ] sent [IPCP ConfReq id=0x3 ] rcvd [CCP ConfAck id=0x2 ] MPPE 128 bit, stateless compression enabled rcvd [IPCP ConfAck id=0x3 ] Cannot determine ethernet address for proxy ARP local IP address 168.192.232.42 remote IP address 168.192.232.31 Script /etc/ppp/ip-up started (pid 14084) Script /etc/ppp/ip-up finished (pid 14084), status = 0x0

http://pptpclient.sourceforge.net/howto-diagnosis.phtml#confreqacknakrej

你可能感兴趣的:(pptp与GRE)

斤斤计较的婚姻到底有多难？白心之岂必有为
很多人私聊我会问到在哪个人群当中斤斤计较的人最多？我都会回答他，一般婚姻出现问题的斤斤计较的人士会非常多，以我多年经验，在婚姻落的一塌糊涂的人当中，斤斤计较的人数占比在20～30%以上，也就是说10个婚姻出现问题的斤斤计较的人有2-3个有多不减。在婚姻出问题当中，有大量的心理不平衡的、尖酸刻薄的怨妇。在婚姻中仅斤斤计较有两种类型：第一种是物质上的，另一种是精神上的。在物质与精神上抠门已经严重的影响
QQ群采集助手，精准引流必备神器 2401_87347160 其他经验分享
功能概述微信群查找与筛选工具是一款专为微信用户设计的辅助工具，它通过关键词搜索功能，帮助用户快速找到相关的微信群，并提供筛选是否需要验证的群组的功能。主要功能关键词搜索：用户可以输入关键词，工具将自动查找包含该关键词的微信群。筛选功能：工具提供筛选机制，用户可以选择是否只显示需要验证或不需要验证的群组。精准引流：通过上述功能，用户可以更精准地找到目标群组，进行有效的引流操作。3.设备需求该工具可以
机器学习与深度学习间关系与区别 ℒℴѵℯ心·动ꦿ໊ོ꫞ 人工智能学习深度学习 python
一、机器学习概述定义机器学习（MachineLearning,ML）是一种通过数据驱动的方法，利用统计学和计算算法来训练模型，使计算机能够从数据中学习并自动进行预测或决策。机器学习通过分析大量数据样本，识别其中的模式和规律，从而对新的数据进行判断。其核心在于通过训练过程，让模型不断优化和提升其预测准确性。主要类型1.监督学习（SupervisedLearning）监督学习是指在训练数据集中包含输入
随笔 | 仙一般的灵气海思沧海
仙岛今天，我看了你全部，似乎已经进入你的世界我不知道，这是否是梦幻，还是你仙一般的灵气吸引了我也许每一个人都要有一份属于自己的追求，这样才能够符合人生的梦想，生活才能够充满着阳光与快乐我不知道，我为什么会这样的感叹，是在感叹自己的人生，还是感叹自己一直没有孜孜不倦的追求只感觉虚度了光阴，每天活在自己的梦中，活在一个不真实的世界是在逃避自己，还是在逃避周围的一切有时候我嘲笑自己，嘲笑自己如此的虚无，
一百九十四章. 自相矛盾巨木擎天
唉！就这么一夜，林子感觉就像过了很多天似的，先是回了阳间家里，遇到了那么多不可思议的事情儿。特别是小伙伴们，第二次与自己见面时，僵硬的表情和恐怖的气氛，让自己如坐针毡，打从心眼里难受！还有东子，他现在还好吗？有没有被人欺负？护城河里的小鱼小虾们，还都在吗？水不会真的干枯了吧？那对相亲相爱漂亮的太平鸟儿，还好吧！春天了，到了做窝、下蛋、喂养小鸟宝宝的时候了，希望它们都能够平安啊！虽然没有看见家人，也
微服务下功能权限与数据权限的设计与实现 nbsaas-boot 微服务 java 架构
在微服务架构下，系统的功能权限和数据权限控制显得尤为重要。随着系统规模的扩大和微服务数量的增加，如何保证不同用户和服务之间的访问权限准确、细粒度地控制，成为设计安全策略的关键。本文将讨论如何在微服务体系中设计和实现功能权限与数据权限控制。1.功能权限与数据权限的定义功能权限：指用户或系统角色对特定功能的访问权限。通常是某个用户角色能否执行某个操作，比如查看订单、创建订单、修改用户资料等。数据权限：
理解Gunicorn：Python WSGI服务器的基石范范0825 ipython linux 运维
理解Gunicorn：PythonWSGI服务器的基石介绍Gunicorn，全称GreenUnicorn，是一个为PythonWSGI（WebServerGatewayInterface）应用设计的高效、轻量级HTTP服务器。作为PythonWeb应用部署的常用工具，Gunicorn以其高性能和易用性著称。本文将介绍Gunicorn的基本概念、安装和配置，帮助初学者快速上手。1.什么是Gunico
学点心理知识，呵护孩子健康静候花开_7090
昨天听了华中师范大学教育管理学系副教授张玲老师的《哪里才是学生心理健康的最后庇护所，超越教育与技术的思考》的讲座。今天又重新学习了一遍，收获匪浅。张玲博士也注意到了当今社会上的孩子由于心理问题导致的自残、自杀及伤害他人等恶性事件。她向我们普及了一个重要的命题，她说心理健康的一些基本命题，我们与我们通常的一些教育命题是不同的，她还举了几个例子，让我们明白我们原来以为的健康并非心理学上的健康。比如如果
《投行人生》读书笔记小蘑菇的树洞
《投行人生》----作者詹姆斯-A-朗德摩根斯坦利副主席40年的职业洞见-很短小精悍的篇幅，比较适合初入职场的新人。第一部分成功的职业生涯需要规划1.情商归为适应能力分享与协作同理心适应能力，更多的是自我意识，你有能力识别自己的情并分辨这些情绪如何影响你的思想和行为。2.对于初入职场的人的建议，细节，截止日期和数据很重要截止日期，一种有效的方法是请老板为你所有的任务进行优先级排序。和老板喝咖啡的好
Long类型前后端数据不一致 igotyback 前端
响应给前端的数据浏览器控制台中response中看到的Long类型的数据是正常的到前端数据不一致前后端数据类型不匹配是一个常见问题，尤其是当后端使用Java的Long类型（64位）与前端JavaScript的Number类型（最大安全整数为2^53-1，即16位）进行数据交互时，很容易出现精度丢失的问题。这是因为JavaScript中的Number类型无法安全地表示超过16位的整数。为了解决这个问
店群合一模式下的社区团购新发展——结合链动 2+1 模式、AI 智能名片与 S2B2C 商城小程序源码说私域人工智能小程序
摘要：本文探讨了店群合一的社区团购平台在当今商业环境中的重要性和优势。通过分析店群合一模式如何将互联网社群与线下终端紧密结合，阐述了链动2+1模式、AI智能名片和S2B2C商城小程序源码在这一模式中的应用价值。这些创新元素的结合为社区团购带来了新的机遇，提升了用户信任感、拓展了营销渠道，并实现了线上线下的完美融合。一、引言随着互联网技术的不断发展，社区团购作为一种新兴的商业模式，在满足消费者日常需
2021-08-26 影幽
在生活中，女人与男人的感悟往往有所不同。人生最大的舞台就是生活，大幕随时都可能拉开，关键是你愿不愿意表演都无法躲避。在生活中，遇事不要急躁，不要急于下结论，尤其生气时不要做决断，要学会换位思考，大事化小小事化了，把复杂的事情尽量简单处理，千万不要把简单的事情复杂化。永远不要扭曲，别人善意，无药可救。昨天是张过期的支票，明天是张信用卡，只有今天才是现金，要善加利用！执着的攀登者不必去与别人比较自己的
高级编程--XML+socket练习题 masa010 java 开发语言
1.北京华北2114.8万人上海华东2,500万人广州华南1292.68万人成都华西1417万人（1）使用dom4j将信息存入xml中（2）读取信息，并打印控制台（3）添加一个city节点与子节点（4）使用socketTCP协议编写服务端与客户端，客户端输入城市ID，服务器响应相应城市信息（5）使用socketTCP协议编写服务端与客户端，客户端要求用户输入city对象，服务端接收并使用dom4j
2018-07-23-催眠日作业-#不一样的31天#-66小鹿小鹿_33
预言日：人总是在逃避命运的路上，与之不期而遇。心理学上有个著名的名词，叫做自证预言；经济学上也有一个很著名的定律叫做，墨菲定律；在灵修派上，还有一个很著名的法则，叫做吸引力法则。这3个领域的词，虽然看起来不太一样，但是他们都在告诉人们一个现象：你越担心什么，就越有可能会发生什么。同样的道理，你越想得到什么，就应该要积极地去创造什么。无论是自证预言，墨菲定律还是吸引力法则，对人都有正反2个维度的影响
回溯 Leetcode 332 重新安排行程 mmaerd Leetcode刷题学习记录 leetcode 算法职场和发展
重新安排行程Leetcode332学习记录自代码随想录给你一份航线列表tickets，其中tickets[i]=[fromi,toi]表示飞机出发和降落的机场地点。请你对该行程进行重新规划排序。所有这些机票都属于一个从JFK（肯尼迪国际机场）出发的先生，所以该行程必须从JFK开始。如果存在多种有效的行程，请你按字典排序返回最小的行程组合。例如，行程[“JFK”,“LGA”]与[“JFK”,“LGB
每日一题——第九十题互联网打工人no1 C语言程序设计每日一练 c语言
题目：判断子串是否与主串匹配#include#include#include//////判断子串是否在主串中匹配//////主串///子串///boolisSubstring(constchar*str,constchar*substr){intlenstr=strlen(str);//计算主串的长度intlenSub=strlen(substr);//计算子串的长度//遍历主字符串，对每个可能得
Python数据分析与可视化实战指南 William数据分析 python python 数据
在数据驱动的时代，Python因其简洁的语法、强大的库生态系统以及活跃的社区，成为了数据分析与可视化的首选语言。本文将通过一个详细的案例，带领大家学习如何使用Python进行数据分析，并通过可视化来直观呈现分析结果。一、环境准备1.1安装必要库在开始数据分析和可视化之前，我们需要安装一些常用的库。主要包括pandas、numpy、matplotlib和seaborn等。这些库分别用于数据处理、数学
《庄子.达生9》钱江潮369
【原文】孔子观于吕梁，县水三十仞，流沫四十里，鼋鼍鱼鳖之所不能游也。见一丈夫游之，以为有苦而欲死也，使弟子并流而拯之。数百步而出，被发行歌而游于塘下。孔子从而问焉，曰：“吾以子为鬼，察子则人也。请问，‘蹈水有道乎’”曰：“亡，吾无道。吾始乎故，长乎性，成乎命。与齐俱入，与汩偕出，从水之道而不为私焉。此吾所以蹈之也。”孔子曰：“何谓始乎故，长乎性，成乎命？”曰：“吾生于陵而安于陵，故也；长于水而安于
水泥质量纠纷案代理词徐宝峰律师
贵州领航建设有限公司诉贵州纳雍隆庆乌江水泥有限公司产品质量纠纷案代理词尊敬的审判长、审判员：贵州千里律师事务所接受被告贵州纳雍隆庆乌江水泥有限公司的委托，指派我担任其诉讼代理人，参加本案的诉讼活动。下面，我结合本案事实和相关法律规定发表如下代理意见，供合议庭评议案件时参考：原告应当举证证明其遭受的损失与被告生产的水泥质量的因果关系。首先水泥是一种粉状水硬性无机胶凝材料。加水搅拌后成浆体，能在空气中
Goolge earth studio 进阶4——路径修改与平滑陟彼高冈yu Google earth studio 进阶教程旅游
如果我们希望在大约中途时获得更多的城市鸟瞰视角。可以将相机拖动到这里并创建一个新的关键帧。camera_target_clip_7EarthStudio会自动平滑我们的路径，所以当我们通过这个关键帧时，不是一个生硬的角度，而是一个平滑的曲线。camera_target_clip_8路径上有贝塞尔控制手柄，允许我们调整路径的形状。右键单击，我们可以选择“平滑路径”，这是默认的自动平滑算法，或者我们可
18-115 一切思考不能有效转化为行动，都TM是扯淡！成长时间线
7月25号写了一篇关于为什么会断更如此严重的反思，然而，之后日更仅仅维持了一周，又出现了这次更严重的现象。从8月2号到昨天8月6号，5天！又是5天没有更文！虽然这次断更时间和上次一样，那为什么说这次更严重？因为上次之后就分析了问题的原因，以及应该如何解决，按理说应该会好转，然而，没过几天严重断更的现象再次出现，想想，经过反思，问题依然没有解决与改变，这让我有些担忧。到底是哪里出了问题，难道我就真的
山东大学小树林支教调研团青青仓木队——翟晓楠山东大学青青仓木队
过了半年，又一次启程，又一次回到支教的初心之地。比起上一次的试探与不安，我更多了一丝稳重与熟练。心境、处境也都随着半个学期的过去而变得不同，半个学期中，身体上的，心理上的，太多的逆境让我变得步履维艰，曲曲折折，弯弯绕绕，我仿佛打不起精神，没有胃口，没有动力。感觉走的不顺畅的时候，支教这个旅程，给了我力量。自告奋勇承担起队长这一职务的我，从组织时的复杂和困难的经历，协调各种问题，从无到有，和校长和队
直返最高等级与直返APP：无需邀请码的返利新体验古楼
随着互联网的普及和电商的兴起，直返模式逐渐成为一种流行的商业模式。在这种模式下，消费者通过购买产品或服务，获得一定的返利，并可以分享给更多的人。其中，直返最高等级和直返APP是直返模式中的重要概念和工具。本文将详细介绍直返最高等级的概念、直返APP的使用以及与邀请码的关系。【高省】APP（高佣金领导者）是一个自用省钱佣金高，分享推广赚钱多的平台，百度有几百万篇报道，运行三年，稳定可靠。高省APP，
DIV+CSS+JavaScript技术制作网页（旅游主题网页设计与制作）云南大理 STU学生网页设计网页设计期末网页作业 html静态网页 html5期末大作业网页设计 web大作业
️精彩专栏推荐作者主页:【进入主页—获取更多源码】web前端期末大作业：【HTML5网页期末作业(1000套)】程序员有趣的告白方式：【HTML七夕情人节表白网页制作(110套)】文章目录二、网站介绍三、网站效果▶️1.视频演示2.图片演示四、网站代码HTML结构代码CSS样式代码五、更多源码二、网站介绍网站布局方面：计划采用目前主流的、能兼容各大主流浏览器、显示效果稳定的浮动网页布局结构。网站程
2020-04-12每天三百字之连接与替代冷眼看潮
不知道是不是好为人师，有时候还真想和别人分享一下我对某些现象的看法或者解释。人类社会不断发展进步的过程，就是不断连接与替代的过程。人类发现了火并应用火以后，告别了茹毛饮血的野兽般的原始生活（火烧、烹饪替代了生食）人类用石器代替了完全手工，工具的使用使人类进步一大步。类似这样的替代还有很多，随着科技的发展，有更多的原始的事物被替代，代之以更高效、更先进的技术。在近现代，汽车替代了马车，高速公路和铁路
探索OpenAI和LangChain的适配器集成：轻松切换模型提供商 nseejrukjhad langchain easyui 前端 python
#探索OpenAI和LangChain的适配器集成：轻松切换模型提供商##引言在人工智能和自然语言处理的世界中，OpenAI的模型提供了强大的能力。然而，随着技术的发展，许多人开始探索其他模型以满足特定需求。LangChain作为一个强大的工具，集成了多种模型提供商，通过提供适配器，简化了不同模型之间的转换。本篇文章将介绍如何使用LangChain的适配器与OpenAI集成，以便轻松切换模型提供商
利用Requests Toolkit轻松完成HTTP请求 nseejrukjhad http 网络协议网络 python
RequestsToolkit的力量：轻松构建HTTP请求Agent在现代软件开发中，API请求是与外部服务交互的核心。RequestsToolkit提供了一种便捷的方式，帮助开发者构建自动化的HTTP请求Agent。本文旨在详细介绍RequestsToolkit的设置、使用和潜在挑战。引言RequestsToolkit是一个强大的工具包，可用于构建执行HTTP请求的智能代理。这对于想要自动化与外
数组去重好奇的猫猫猫
整理自js中基础数据结构数组去重问题思考？如何去除数组中重复的项例如数组：[1,3,4,3,5]我们在做去重的时候，一开始想到的肯定是，逐个比较，外面一层循环，内层后一个与前一个一比较，如果是久不将当前这一项放进新的数组，挨个比较完之后返回一个新的去过重复的数组不好的实践方式上述方法效率极低，代码量还多，思考？有没有更好的方法这时候不禁一想当然有了！！！hashtable啊，通过对象的hash办法
春季养肝正当时 dxn悟
重温快乐2023年2月4日立春。春天来了，春暖花开，小鸟欢唱，那在这样的季节我们如何养肝呢？自然界的春季对应中医五行的木，人体五脏肝属木，“木曰曲直”，是以树干曲曲直直地向上、向外伸长舒展的生发姿态，来形容具有生长、升发、条达、舒畅等特征的食物及现象。根据中医天人相应的理念，肝五行属木，喜条达，主疏泄，与春天相应，所以春天最适合养肝。养肝首先要少生气，因为肝喜条达恶抑郁。人体五志肝为怒，生气发怒最
关于城市旅游的HTML网页设计——(旅游风景云南 5页)HTML+CSS+JavaScript 二挡起步 web前端期末大作业 javascript html css 旅游风景
⛵源码获取文末联系✈Web前端开发技术描述网页设计题材，DIV+CSS布局制作,HTML+CSS网页设计期末课程大作业|游景点介绍|旅游风景区|家乡介绍|等网站的设计与制作|HTML期末大学生网页设计作业，Web大学生网页HTML：结构CSS：样式在操作方面上运用了html5和css3，采用了div+css结构、表单、超链接、浮动、绝对定位、相对定位、字体样式、引用视频等基础知识JavaScrip
微信开发者验证接口开发 362217990 微信开发者 token 验证
微信开发者接口验证。 Token，自己随便定义，与微信填写一致就可以了。根据微信接入指南描述 http://mp.weixin.qq.com/wiki/17/2d4265491f12608cd170a95559800f2d.html 第一步：填写服务器配置第二步：验证服务器地址的有效性第三步：依据接口文档实现业务逻辑这里主要讲第二步验证服务器有效性。建一个
一个小编程题-类似约瑟夫环问题 BrokenDreams 编程
今天群友出了一题：一个数列,把第一个元素删除,然后把第二个元素放到数列的最后,依次操作下去,直到把数列中所有的数都删除,要求依次打印出这个过程中删除的数。 &
linux复习笔记之bash shell (5) 关于减号-的作用 eksliang linux关于减号“-”的含义 linux关于减号“-”的用途 linux关于“-”的含义 linux关于减号的含义
转载请出自出处： http://eksliang.iteye.com/blog/2105677 管道命令在bash的连续处理程序中是相当重要的，尤其在使用到前一个命令的studout（标准输出）作为这次的stdin（标准输入）时，就显得太重要了，某些命令需要用到文件名，例如上篇文档的的切割命令（split）、还有
Unix(3) 18289753290 unix ksh
1)若该变量需要在其他子进程执行，则可用"$变量名称"或${变量}累加内容什么是子进程？在我目前这个shell情况下，去打开一个新的shell，新的那个shell就是子进程。一般状态下，父进程的自定义变量是无法在子进程内使用的，但通过export将变量变成环境变量后就能够在子进程里面应用了。 2)条件判断： &&代表and ||代表or&nbs
关于ListView中性能优化中图片加载问题酷的飞上天空 ListView
ListView的性能优化网上很多信息，但是涉及到异步加载图片问题就会出现问题。具体参看上篇文章http://314858770.iteye.com/admin/blogs/1217594 如果每次都重新inflate一个新的View出来肯定会造成性能损失严重，可能会出现listview滚动是很卡的情况，还会出现内存溢出。现在想出一个方法就是每次都添加一个标识，然后设置图
德国总理默多克：给国人的一堂“震撼教育”课永夜-极光教育
http://bbs.voc.com.cn/topic-2443617-1-1.html德国总理默多克：给国人的一堂“震撼教育”课　安吉拉—默克尔，一位经历过社会主义的东德人，她利用自己的博客，发表一番来华前的谈话，该说的话，都在上面说了，全世界想看想传播——去看看默克尔总理的博客吧！　　德国总理默克尔以她的低调、朴素、谦和、平易近人等品格给国人留下了深刻印象。她以实际行动为中国人上了一堂
关于Java继承的一个小问题。。。随便小屋 java
今天看Java 编程思想的时候遇见一个问题，运行的结果和自己想想的完全不一样。先把代码贴出来！ //CanFight接口 interface Canfight { void fight(); } //ActionCharacter类 class ActionCharacter { public void fight() { System.out.pr
23种基本的设计模式 aijuans 设计模式
Abstract Factory：提供一个创建一系列相关或相互依赖对象的接口，而无需指定它们具体的类。　　Adapter：将一个类的接口转换成客户希望的另外一个接口。A d a p t e r模式使得原本由于接口不兼容而不能一起工作的那些类可以一起工作。　　Bridge：将抽象部分与它的实现部分分离，使它们都可以独立地变化。　　Builder：将一个复杂对象的构建与它的表示分离，使得同
《周鸿祎自述：我的互联网方法论》读书笔记 aoyouzi 读书笔记
从用户的角度来看,能解决问题的产品才是好产品,能方便/快速地解决问题的产品,就是一流产品. 商业模式不是赚钱模式一款产品免费获得海量用户后,它的边际成本趋于0,然后再通过广告或者增值服务的方式赚钱,实际上就是创造了新的价值链. 商业模式的基础是用户,木有用户,任何商业模式都是浮云.商业模式的核心是产品,本质是通过产品为用户创造价值. 商业模式还包括寻找需求
JavaScript动态改变样式访问技术百合不是茶 JavaScript style属性 ClassName属性
一:style属性格式: HTML元素.style.样式属性="值"; 创建菜单:在html标签中创建或者在head标签中用数组创建 <html> <head> <title>style改变样式</title> </head> &l
jQuery的deferred对象详解 bijian1013 jquery deferred对象
jQuery的开发速度很快，几乎每半年一个大版本，每两个月一个小版本。每个版本都会引入一些新功能，从jQuery 1.5.0版本开始引入的一个新功能----deferred对象。 &nb
淘宝开放平台TOP Bill_chen C++c 物流 C#
淘宝网开放平台首页：http://open.taobao.com/ 淘宝开放平台是淘宝TOP团队的产品，TOP即TaoBao Open Platform，是淘宝合作伙伴开发、发布、交易其服务的平台。支撑TOP的三条主线为： 1.开放数据和业务流程 * 以API数据形式开放商品、交易、物流等业务； &
【大型网站架构一】大型网站架构概述 bit1129 网站架构
大型互联网特点面对海量用户、海量数据大型互联网架构的关键指标高并发高性能高可用高可扩展性线性伸缩性安全性大型互联网技术要点前端优化 CDN缓存反向代理 KV缓存消息系统分布式存储 NoSQL数据库搜索监控安全想到的问题： 1.对于订单系统这种事务型系统，如
eclipse插件hibernate tools安装白糖_ Hibernate
eclipse helios(3.6)版 1.启动eclipse 2.选择 Help > Install New Software...> 3.添加如下地址： http://download.jboss.org/jbosstools/updates/stable/helios/ 4.选择性安装：hibernate tools在All Jboss tool
Jquery easyui Form表单提交注意事项 bozch jquery easyui
jquery easyui对表单的提交进行了封装，提交的方式采用的是ajax的方式，在开发的时候应该注意的事项如下： 1、在定义form标签的时候，要将method属性设置成post或者get，特别是进行大字段的文本信息提交的时候，要将method设置成post方式提交，否则页面会抛出跨域访问等异常。所以这个要
Trie tree(字典树)的Java实现及其应用-统计以某字符串为前缀的单词的数量 bylijinnan java实现
import java.util.LinkedList; public class CaseInsensitiveTrie { /** 字典树的Java实现。实现了插入、查询以及深度优先遍历。 Trie tree's java implementation.(Insert,Search,DFS) Problem Description Igna
html css 鼠标形状样式汇总 chenbowen00 html css
css鼠标手型cursor中hand与pointer Example：CSS鼠标手型效果 <a href="#" style="cursor:hand">CSS鼠标手型效果</a><br/> Example：CSS鼠标手型效果 <a href="#" style=&qu
[IT与投资]IT投资的几个原则 comsci it
无论是想在电商,软件,硬件还是互联网领域投资,都需要大量资金,虽然各个国家政府在媒体上都给予大家承诺,既要让市场的流动性宽松,又要保持经济的高速增长....但是,事实上,整个市场和社会对于真正的资金投入是非常渴望的,也就是说,表面上看起来,市场很活跃,但是投入的资金并不是很充足的......
oracle with语句详解 daizj oracle with with as
oracle with语句详解转在oracle中，select 查询语句，可以使用with,就是一个子查询，oracle 会把子查询的结果放到临时表中，可以反复使用例子:注意，这是sql语句，不是pl/sql语句，可以直接放到jdbc执行的 ----------------------------------------------------------------
hbase的简单操作 deng520159 数据库 hbase
近期公司用hbase来存储日志,然后再来分析 ,把hbase开发经常要用的命令找了出来. 用ssh登陆安装hbase那台linux后用hbase shell进行hbase命令控制台! 表的管理 1）查看有哪些表 hbase(main)> list 2）创建表 # 语法：create <table>, {NAME => <family&g
C语言scanf继续学习、算术运算符学习和逻辑运算符 dcj3sjt126com c
/* 2013年3月11日20:37:32 地点：北京潘家园功能：完成用户格式化输入多个值目的：学习scanf函数的使用 */ # include <stdio.h> int main(void) { int i, j, k; printf("please input three number:\n"); //提示用
2015越来越好 dcj3sjt126com 歌曲
越来越好房子大了电话小了感觉越来越好假期多了收入高了工作越来越好商品精了价格活了心情越来越好天更蓝了水更清了环境越来越好活得有奔头人会步步高想做到你要努力去做到幸福的笑容天天挂眉梢越来越好婆媳和了家庭暖了生活越来越好孩子高了懂事多了学习越来越好朋友多了心相通了大家越来越好道路宽了心气顺了日子越来越好活的有精神人就不显
java.sql.SQLException: Value '0000-00-00' can not be represented as java.sql.Tim feiteyizu mysql
数据表中有记录的time字段（属性为timestamp）其值为：“0000-00-00 00:00:00” 程序使用select 语句从中取数据时出现以下异常： java.sql.SQLException:Value '0000-00-00' can not be represented as java.sql.Date java.sql.SQLException: Valu
Ehcache（07）——Ehcache对并发的支持 234390216 并发 ehcache 锁 ReadLock WriteLock
Ehcache对并发的支持在高并发的情况下，使用Ehcache缓存时，由于并发的读与写，我们读的数据有可能是错误的，我们写的数据也有可能意外的被覆盖。所幸的是Ehcache为我们提供了针对于缓存元素Key的Read（读）、Write（写）锁。当一个线程获取了某一Key的Read锁之后，其它线程获取针对于同
mysql中blob,text字段的合成索引 jackyrong mysql
在mysql中，原来有一个叫合成索引的，可以提高blob,text字段的效率性能，但只能用在精确查询，核心是增加一个列，然后可以用md5进行散列，用散列值查找则速度快比如： create table abc(id varchar(10),context blog,hash_value varchar(40)); insert into abc(1,rep
逻辑运算与移位运算 latty 位运算逻辑运算
源码：正数的补码与原码相同例+7 源码：00000111 补码：00000111 （用8位二进制表示一个数）负数的补码：符号位为1，其余位为该数绝对值的原码按位取反；然后整个数加1。 -7 源码： 10000111 ，其绝对值为00000111 取反加一：11111001 为-7补码已知一个数的补码，求原码的操作分两种情况：
利用XSD 验证XML文件 newerdragon java xml xsd
XSD文件（XML Schema 语言也称作 XML Schema 定义（XML Schema Definition，XSD）。具体使用方法和定义请参看： http://www.w3school.com.cn/schema/index.asp java自jdk1.5以上新增了SchemaFactory类可以实现对XSD验证的支持，使用起来也很方便。以下代码可用在J
搭建 CentOS 6 服务器(12) - Samba rensanning centos
（1）安装 # yum -y install samba Installed: samba.i686 0:3.6.9-169.el6_5 # pdbedit -a rensn new password:123456 retype new password:123456 …… （2）Home文件夹 # mkdir /etc
Learn Nodejs 01 toknowme nodejs
（1）下载nodejs https://nodejs.org/download/ 选择相应的版本进行下载（2）安装nodejs 安装的方式比较多，请baidu下我这边下载的是“node-v0.12.7-linux-x64.tar.gz”这个版本（1）上传服务器（2）解压 tar -zxvf node-v0.12.
jquery控制自动刷新的代码举例 xp9802 jquery
1、html内容部分复制代码代码示例: <div id='log_reload'> <select name="id_s" size="1"> <option value='2'>-2s-</option> <option value='3'>-3s-</option

pptp问题调试详解

Contents

Conventions

Installing kernel modules

Installing pppd

ppp <= 2.3.15 conflicts with kernel

Installing pptp

Installing pptpconfig

Running pptpconfig

Fatal error: php-gtk: Could not open display

Running pptp-command

insecure dependency

WARNING: the line: contains unsafe characters

ERROR! Connection timed out

New interface not found

Running pptp

pptp: command not found

connect: Connection Refused

connect: Network is unreachable

connect: No route to host

Input/output error

Protocol not available

Operation not permitted

buffering out-of-order packet

Running pppd (before connection)

pppd cannot load kernel module ppp_generic

Couldn't set tty to PPP discipline: Invalid argument

write: warning: Input/output error

none of the available passwords would let it use an IP address

Running pppd (during connection)

CHAP authentication failed

No dialin permission

Unknown MS-CHAP authentication failure: E=649

Remote message: Unknown authentication failure: E=649

failed to authenticate ourselves to peer

remote system is required to authenticate itself

Could not determine local IP address

LCP: No network protocols running

LCP: timeout sending Config-Requests

No GRE received by PPTP Client

No GRE transmitted by PPTP Server

Invalid GRE packets transmitted by server

No GRE packets transmitted by client

Invalid GRE packets transmitted by client

LCP ConfRej

LCP ConfRej

No auth is possible

CCP: timeout sending Config-Requests

CCP ConfNak

LCP terminated by peer (peer refused to authenticate)

LCP terminated by peer (garbled text)

EAP Response ... LCP TermReq

CCP terminated by peer

CCP ConfRej

CCP: No compression negotiated

CCP ConfRej

MPPE required, but MS-CHAP[v2] auth not performed.

MPPE required but peer refused

MPPE required but peer negotiation failed

LCP TermReq id=0x3 "MPPE required but not available"

MPPE required, but kernel has no support.

Received bad configure-ack

LCP ConfNak id=0x1

Running pppd (after connection)

Unsupported protocol 0x2145 received

Protocol-Reject for unsupported protocol 0x????

LCP ProtRej id=0x??

Connection closes after 60 seconds

RTNETLINK answers: File exists

huge transmit data counters

LCP EchoReq without LCP EchoRep

Not enough space to encrypt packet

Connections via tunnel freeze

Connections via tunnel fail or timeout

Terminating on signal 2

Loading kernel modules

init_module: File exists

Other Problems

Error 629, you have been disconnected

Fault Tree