'\" te
.\" Copyright (c) 1989 Carnegie Mellon University. All rights reserved.
.\" Redistribution and use in source and binary forms are permitted provided that the above copyright notice and this paragraph are duplicated in all such forms and that any documentation, advertising materials, and other materials related to such distribution and use acknowledge that the software was developed by Carnegie Mellon University.  The name of the University may not be used to endorse or promote products derived from this software without specific prior written permission.  THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED
.\" WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR A PARTICULAR PURPOSE.
.\" Portions Copyright (c) 2008, Sun Microsystems, Inc. All Right Reserved.
.TH PPPD 1M "Nov 21, 2001"
.SH NAME
pppd \- point to point protocol daemon
.SH SYNOPSIS
.LP
.nf
\fBpppd\fR [\fItty_name\fR] [\fIspeed\fR] [\fIoptions\fR]
.fi

.SH DESCRIPTION
.sp
.LP
The point-to-point protocol (PPP) provides a method for transmitting datagrams
over serial point-to-point links. PPP is composed of three components: a
facility for encapsulating datagrams over serial links, an extensible link
control protocol (LCP), and a family of network control protocols (NCP) for
establishing and configuring different network-layer protocols.
.sp
.LP
The encapsulation scheme is provided by driver code in the kernel. \fBpppd\fR
provides the basic LCP authentication support and several NCPs for establishing
and configuring the Internet Protocol (referred to as the IP Control Protocol
or "IPCP") and IPv6 (IPV6CP).
.SH OPTIONS
.sp
.LP
The following sections discuss the \fBpppd\fR options:
.SS "Options Files"
.sp
.LP
Options are taken from files and the command line. \fBpppd\fR reads options
from the files \fB/etc/ppp/options\fR, \fB$HOME/.ppprc\fR and
\fB/etc/ppp/options.\fR\fIttyname\fR (in that order) before processing the
options on the command line. (Command-line options are scanned for the terminal
name before the \fBoptions\fR.\fIttyname\fR file is read.) To form the name of
the \fBoptions\fR.\fIttyname\fR file, the initial \fB/dev/\fR is removed from
the terminal name, and any remaining forward slash characters (/) are replaced
with dots. For example, with serial device \fB/dev/cua/a\fR, option file
\fB/etc/ppp/options.cua.a\fR is read.
.sp
.LP
An options file is parsed into a series of words that are delimited by
whitespace. Whitespace can be included in a word by enclosing the word in
double-quotes ("). A backslash (\e) quotes the succeeding character. A hash (#)
starts a comment, which continues until the end of the line. There is no
restriction on using the \fBfile\fR or \fBcall\fR options within an options
file.
.SS "Frequently Used Options"
.sp
.ne 2
.na
\fB\fB<tty_name>\fR \fR
.ad
.RS 23n
Communicate over the named device. The string \fB/dev/\fR is prepended if
necessary. If no device name is given, or if the name of the terminal connected
to the standard input is given, \fBpppd\fR uses that terminal and does not fork
to put itself in the background. A value for this option from a privileged
source cannot be overridden by a non-privileged user.
.RE

.sp
.ne 2
.na
\fB\fB<speed>\fR \fR
.ad
.RS 23n
Set the baud rate to <\fBspeed\fR> (a decimal number). The default is to leave
the baud rate unchanged. This option is normally needed for dial-out only.
.RE

.sp
.ne 2
.na
\fB\fBasyncmap\fR \fB\fI<map>\fR\fR \fR
.ad
.RS 23n
Set the \fBasync\fR character map to \fI<map>\fR\&. The map describes which
control characters cannot be successfully received over the serial line.
\fBpppd\fR asks the peer to send these characters as a 2-byte escape sequence.
The argument is a 32 bit hex number, with each bit representing a character to
escape. Bit 0 (00000001) represents the character 0x00; bit 31 (80000000)
represents the character 0x1f or ^_. If multiple \fBasyncmap\fR options are
given, the values are \fBORed\fR together. If no \fBasyncmap\fR option is
given, \fBpppd\fR attempts to negotiate a value of 0. If the peer agrees, this
disables escaping of the standard control characters. Use the
\fBdefault-asyncmap\fR option to disable negotiation and escape all control
characters.
.RE

.sp
.ne 2
.na
\fB\fBauth\fR \fR
.ad
.RS 23n
Require the peer to authenticate itself before allowing network packets to be
sent or received. This option is the default if the system has a default route.
If the \fBauth\fR or the \fBnoauth\fR option is not specified, \fBpppd\fR
allows the peer to use only those IP addresses to which the system does not
already have a route.
.RE

.sp
.ne 2
.na
\fB\fBcall\fR \fB\fIname\fR\fR \fR
.ad
.RS 23n
Read options from the file \fB/etc/ppp/peers/\fR\fIname\fR. This file may
contain privileged options, including \fBnoauth\fR, even if \fBpppd\fR is not
being run by root. The \fIname\fR string may not begin with a slash ("/") or
include consecutive periods \fB("..")\fR as a pathname component.
.RE

.sp
.ne 2
.na
\fB\fBcallback\fR \fB\fInumber\fR\fR \fR
.ad
.RS 23n
Request a callback to the given telephone number using Microsoft CBCP.
.RE

.sp
.ne 2
.na
\fB\fBconnect\fR \fB\fIscript\fR\fR \fR
.ad
.RS 23n
Use the executable or shell command specified by \fIscript\fR to set up the
serial line. This script would typically use the \fBchat\fR(1M) program to dial
the modem and start the remote \fBPPP\fR session. A value for this option
originating from a privileged source cannot be overridden by a non-privileged
user.
.RE

.sp
.ne 2
.na
\fB\fBcrtscts\fR \fR
.ad
.RS 23n
Use hardware flow control, that is, RTS/CTS, to control the flow of data on the
serial port. If the \fBcrtscts\fR, \fBnocrtscts\fR, \fBcdtrcts\fR or
\fBnocdtrcts\fR option is not provided, the hardware flow control setting for
the serial port is left unchanged. Some serial ports lack a true RTS output and
use this mode to implement unidirectional flow control. The serial port
suspends transmission when requested by the modem by means of CTS but cannot
request the modem to stop sending to the computer. This mode allows the use of
DTR as a modem control line.
.RE

.sp
.ne 2
.na
\fB\fBdefaultroute\fR \fR
.ad
.RS 23n
Add a default route to the system routing tables when IPCP negotiation
successfully completes, using the peer as the gateway. This entry is removed
when the \fBPPP\fR connection is broken. This option is privileged if the
\fBnodefaultroute\fR option is specified.
.RE

.sp
.ne 2
.na
\fB\fBdisconnect\fR \fB \fIscript\fR\fR \fR
.ad
.RS 23n
Run the executable or shell command specified by \fIscript\fR after \fBpppd\fR
terminates the link. Typically, this script is used to command the modem to
hang up if hardware modem control signals are not available. \fBdisconnect\fR
is not run if the modem has already hung up. A value for this option
originating from a privileged source cannot be overridden by a non-privileged
user.
.RE

.sp
.ne 2
.na
\fB\fBescape\fR \fB\fIxx,yy,...\fR\fR \fR
.ad
.RS 23n
Specifies that certain characters be escaped on transmission regardless of
whether the peer requests them to be escaped with its \fBasync\fR control
character map. The characters to be escaped are specified as a list of hex
numbers separated by commas. Note that almost any character can be specified
for the \fBescape\fR option, unlike the \fBasyncmap\fR option which allows only
control characters to be specified. Characters that cannot be escaped are those
containing hex values 0x20 through 0x3f and 0x5e.
.RE

.sp
.ne 2
.na
\fB\fBfile\fR \fB\fIname\fR\fR \fR
.ad
.RS 23n
Read options from file \fIname\fR. If this option is used on the command line
or in \fB$HOME/.ppprc\fR, the file must be readable by the user invoking
\fBpppd\fR. See  for a list of files that \fBpppd\fR always reads, regardless
of the use of this option.
.RE

.sp
.ne 2
.na
\fB\fBinit\fR \fB \fIscript\fR \fR \fR
.ad
.RS 23n
Run the executable or shell command specified by \fIscript\fR to initialize the
serial line. This script would typically use the \fBchat\fR(1M) program to
configure the modem to enable auto-answer. A value for this option from a
privileged source cannot be overridden by a non-privileged user.
.RE

.sp
.ne 2
.na
\fB\fBlock\fR \fR
.ad
.RS 23n
Directs \fBpppd\fR to create a UUCP-style lock file for the serial device to
ensure exclusive access to the device.
.RE

.sp
.ne 2
.na
\fB\fBmru\fR \fB\fIn\fR\fR \fR
.ad
.RS 23n
Set the Maximum Receive Unit (MRU) value to \fIn\fR. \fBpppd\fR asks the peer
to send packets of no more than \fIn\fR bytes. Minimum MRU value is 128.
Default MRU value is 1500. A value of 296 is recommended for slow links (40
bytes for TCP/IP header + 256 bytes of data). For IPv6, MRU must be at least
1280.
.RE

.sp
.ne 2
.na
\fB\fBmtu\fR \fB\fIn\fR\fR \fR
.ad
.RS 23n
Set the Maximum Transmit Unit (MTU) value to \fIn\fR. Unless the peer requests
a smaller value via MRU negotiation, \fBpppd\fR requests the kernel networking
code to send data packets of no more than \fIn\fR bytes through the PPP network
interface. For IPv6, MTU must be at least 1280.
.RE

.sp
.ne 2
.na
\fB\fBpassive\fR \fR
.ad
.RS 23n
Enables the "passive" option in the LCP. With this option, \fBpppd\fR attempts
to initiate a connection; if no reply is received from the peer, \fBpppd\fR
waits passively for a valid LCP packet instead of exiting, as it would without
this option.
.RE

.SS "Options"
.sp
.ne 2
.na
\fB\fB<local_IP_address>:<remote_IP_address>\fR \fR
.ad
.sp .6
.RS 4n
Set the local and/or remote interface IP addresses. Either one may be omitted,
but the colon is required. The IP addresses are specified with a host name or
in decimal dot notation, for example: \fB:10.1.2.3\fR. The default local
address is the first IP address of the system unless the \fBnoipdefault\fR
option is provided. The remote address is obtained from the peer if not
specified in any option. Thus, in simple cases, this option is not required. If
a local and/or remote IP address is specified with this option, \fBpppd\fR will
not accept a different value from the peer in the IPCP negotiation unless the
\fBipcp-accept-local\fR and/or \fBipcp-accept-remote\fR options are given,
respectively.
.RE

.sp
.ne 2
.na
\fB\fBallow-fcs\fR \fB\fIfcs-type\fR\fR \fR
.ad
.sp .6
.RS 4n
Set allowable FCS type(s) for data sent to the peer. The \fIfcs-type\fR is a
comma-separated list of "crc16", "crc32", "null", or integers. By default, all
known types are allowed. If this option is specified and the peer requests a
type not listed, a LCP Configure-Nak is sent to request only the listed types.
.RE

.sp
.ne 2
.na
\fB\fBallow-ip\fR \fB\fIaddress(es)\fR\fR \fR
.ad
.sp .6
.RS 4n
Allow peers to use the given IP address or subnet without authenticating
themselves. The parameter is parsed in the same manner as each element of the
list of allowed IP addresses is parsed in the secrets files. See the  section
more more details.
.RE

.sp
.ne 2
.na
\fB\fBbsdcomp\fR \fB\fInr,nt\fR\fR \fR
.ad
.sp .6
.RS 4n
Request that the peer compress packets that it sends using the BSD-Compress
scheme, with a maximum code size of \fInr\fR bits, and agree to compress
packets sent to the peer with a maximum code size of \fInt\fR bits. If \fInt\fR
is not specified, it defaults to the value given for \fInr\fR. Values in the
range 9 to 15 may be used for \fInr\fR and \fInt\fR; larger values provide
better compression but consume more kernel memory for compression dictionaries.
Alternatively, a value of 0 for \fInr\fR or \fInt\fR disables compression in
the corresponding direction. Use \fBnobsdcomp\fR or \fBbsdcomp 0\fR to disable
BSD-Compress compression entirely. If this option is read from a privileged
source, a nonprivileged user may not specify a code size larger than the value
from the privileged source.
.RE

.sp
.ne 2
.na
\fB\fBcdtrcts\fR \fR
.ad
.sp .6
.RS 4n
Use a non-standard hardware flow control such as DTR/CTS to control the flow of
data on the serial port. If the \fBcrtscts\fR, \fBnocrtscts\fR, \fBcdtrcts\fR
or \fBnocdtrcts\fR option is not specified, the hardware flow control setting
for the serial port is left unchanged. Some serial ports lack a true RTS
output. Such serial ports use this mode to implement true bi-directional flow
control. Note that this flow control mode does not permit using DTR as a modem
control line.
.RE

.sp
.ne 2
.na
\fB\fBchap-interval\fR \fB\fIn\fR\fR\fR
.ad
.sp .6
.RS 4n
If this option is given, \fBpppd\fR will rechallenge the peer every \fIn\fR
seconds.
.RE

.sp
.ne 2
.na
\fB\fBchap-max-challenge\fR \fB\fIn\fR\fR \fR
.ad
.sp .6
.RS 4n
Set the maximum number of CHAP challenge transmissions to \fIn\fR (default 10).
.RE

.sp
.ne 2
.na
\fB\fBchap-restart\fR \fB\fIn\fR\fR \fR
.ad
.sp .6
.RS 4n
Set the CHAP restart interval (retransmission timeout for challenges) to
\fIn\fR seconds. The default is 3.
.RE

.sp
.ne 2
.na
\fB\fBconnect-delay\fR \fB\fIn\fR\fR \fR
.ad
.sp .6
.RS 4n
Wait for up to \fIn\fR milliseconds after the connect script finishes for a
valid PPP packet from the peer. When the wait period elapses or when a valid
PPP packet is received from the peer, \fBpppd\fR begins negotiation by sending
its first LCP packet. The default value is 1000 (1 second). A wait period
applies only if the \fBconnect\fR or \fBpty\fR option is used.
.RE

.sp
.ne 2
.na
\fB\fBdatarate\fR \fB\fIn\fR\fR \fR
.ad
.sp .6
.RS 4n
Set maximum data rate to \fIn\fR (in bytes per second) when using the
\fBpty\fR, \fBnotty\fR, \fBrecord\fR, or \fBsocket\fR options.
.RE

.sp
.ne 2
.na
\fB\fBdebug\fR \fR
.ad
.sp .6
.RS 4n
Enables connection debugging facilities. If this option is given, \fBpppd\fR
logs the contents of all control packets sent or received in a readable form.
The packets are logged through syslog with facility \fBdaemon\fR and level
\fBdebug\fR. This information can be directed to a file by configuring
\fB/etc/syslog.conf\fR appropriately.
.RE

.sp
.ne 2
.na
\fB\fBdefault-asyncmap\fR \fR
.ad
.sp .6
.RS 4n
Disable \fBasyncmap\fR negotiation, forcing all control characters to be
escaped for both the transmit and the receive direction.
.RE

.sp
.ne 2
.na
\fB\fBdefault-fcs\fR \fR
.ad
.sp .6
.RS 4n
Disable FCS Alternatives negotiation entirely. By default, no FCS Alternatives
option is sent to the peer, but the option is accepted. If this option is
specified by the peer, then LCP Configure-Reject is sent.
.RE

.sp
.ne 2
.na
\fB\fBdefault-mru\fR \fR
.ad
.sp .6
.RS 4n
Disable MRU [Maximum Receive Unit] negotiation. With this option, \fBpppd\fR
uses the default MRU value of 1500 bytes for the transmit and receive
directions.
.RE

.sp
.ne 2
.na
\fB\fBdeflate\fR \fB\fInr,nt,e\fR\fR \fR
.ad
.sp .6
.RS 4n
Request that the peer compress packets that it sends, using the \fBdeflate\fR
scheme, with a maximum window size of \fI2**nr\fR bytes, and agree to compress
packets sent to the peer with a maximum window size of \fI2**nt\fR bytes and
effort level of \fIe\fR (1 to 9). If \fInt\fR is not specified, it defaults to
the value given for \fInr\fR. If \fIe\fR is not specified, it defaults to 6.
Values in the range 9 to 15 may be used for \fInr\fR and \fInt\fR; larger
values provide better compression but consume more kernel memory for
compression dictionaries. (Value 8 is not permitted due to a zlib bug.)
Alternatively, a value of 0 for \fInr\fR or \fInt\fR disables compression in
the corresponding direction. Use \fBnodeflate\fR or \fBdeflate 0\fR to disable
\fBdeflate\fR compression entirely. (Note: \fBpppd\fR requests deflate
compression in preference to BSD-Compress if the peer can do either.) If this
option is read from a privileged source, a nonprivileged user may not specify a
code size larger than the value from the privileged source.
.RE

.sp
.ne 2
.na
\fB\fBdemand\fR \fR
.ad
.sp .6
.RS 4n
Initiate the link only on demand, that is, when data traffic is present. With
this option, the remote IP address must be specified by the user on the command
line or in an options file. \fBpppd\fR initially configures and enables the
interface for IP traffic without connecting to the peer. When traffic is
available, \fBpppd\fR connects to the peer and performs negotiation,
authentication and other actions. When completed, \fBpppd\fR passes data
packets across the link. The \fBdemand\fR option implies the \fBpersist\fR
option. If this behavior is not desired, use the \fBnopersist\fR option after
the \fBdemand\fR option. The \fBidle\fR and \fBholdoff\fR options can be used
in conjunction with the \fBdemand\fR option.
.RE

.sp
.ne 2
.na
\fB\fBdomain\fR \fB\fId\fR\fR \fR
.ad
.sp .6
.RS 4n
Append the domain name \fId\fR to the local host name for authentication
purposes. For example, if \fBgethostname()\fR returns the name \fBporsche\fR,
but the fully qualified domain name is \fBporsche.Quotron.COM\fR, you could
specify \fBdomain Quotron.COM\fR. With this configuration, \fBpppd\fR uses the
name \fBporsche.Quotron.COM\fR for accessing secrets in the secrets file and as
the default name when authenticating to the peer. This option is privileged.
.RE

.sp
.ne 2
.na
\fB\fBendpoint\fR \fB\fIendpoint-value\fR\fR \fR
.ad
.sp .6
.RS 4n
Set the endpoint discriminator (normally used for RFC 1990 Multilink PPP
operation). The \fIendpoint-value\fR consists of a class identifier and a
class-dependent value. The class identifier is one of "null," "local," "IP,"
"MAC," "magic," "phone," or a decimal integer. If present, the class-dependent
value is separated from the identifier by a colon (":") or period (".") . This
value may be a standard dotted-decimal IP address for class "IP," an optionally
colon-or-dot separated hex Ethernet address for class "MAC" (must have 6
numbers), or an arbitrary string of bytes specified in hex with optional colon
or dot separators between bytes. Although this option is available, this
implementation does not support multilink.
.RE

.sp
.ne 2
.na
\fB\fBfcs\fR \fB\fIfcs-type\fR\fR \fR
.ad
.sp .6
.RS 4n
Set FCS type(s) desired for data sent by the peer. The \fIfcs-type\fR is a
comma-separated list of \fBcrc16\fR, \fBcrc32\fR, \fBnull\fR, or integers. By
default, an FCS Alternatives option is not specified, and the medium-dependent
FCS type is used. If this option is specified and the peer sends an LCP
Configure-Nak, only the listed types are used. If none are in common, the FCS
Alternatives option is omitted from the next LCP Configure-Request to drop back
to the default.
.RE

.sp
.ne 2
.na
\fB\fBhide-password\fR \fR
.ad
.sp .6
.RS 4n
When logging the contents of PAP packets, this option causes \fBpppd\fR to
exclude the password string from the log. This is the default.
.RE

.sp
.ne 2
.na
\fB\fBholdoff\fR \fB\fIn\fR\fR \fR
.ad
.sp .6
.RS 4n
Specifies how many seconds to wait before re-initiating the link after it
terminates. This option is effective only if the \fBpersist\fR or \fBdemand\fR
option is used. The holdoff period is not applied if the link is terminated
because it was idle.
.RE

.sp
.ne 2
.na
\fB\fBident\fR \fB\fIstring\fR\fR \fR
.ad
.sp .6
.RS 4n
Set the LCP Identification string. The default value is a version string
similar to that displayed by the \fB--version\fR option.
.RE

.sp
.ne 2
.na
\fB\fBidle\fR \fB\fIn\fR\fR \fR
.ad
.sp .6
.RS 4n
Specifies that \fBpppd\fR must disconnect if the link is idle for \fIn\fR
seconds. The link is idle when no data packets (i.e. IP packets) are being sent
or received. Do not use this option with the \fBpersist\fR option but without
the \fBdemand\fR option.
.RE

.sp
.ne 2
.na
\fB\fBipcp-accept-local\fR \fR
.ad
.sp .6
.RS 4n
With this option, \fBpppd\fR accepts the peer's idea of the local IP address,
even if the local IP address is specified in an option.
.RE

.sp
.ne 2
.na
\fB\fBipcp-accept-remote\fR \fR
.ad
.sp .6
.RS 4n
With this option, \fBpppd\fR accepts the peer's idea of its remote IP address,
even if the remote IP address is specified in an option.
.RE

.sp
.ne 2
.na
\fB\fBipcp-max-configure\fR \fB\fIn\fR\fR \fR
.ad
.sp .6
.RS 4n
Set the maximum number of IPCP Configure-Request transmissions to \fIn\fR
(default 10).
.RE

.sp
.ne 2
.na
\fB\fBipcp-max-failure\fR \fB\fIn\fR\fR \fR
.ad
.sp .6
.RS 4n
Set the maximum number of IPCP Configure-NAKs sent before sending
Configure-Rejects instead to \fIn\fR (default 10).
.RE

.sp
.ne 2
.na
\fB\fBipcp-max-terminate\fR \fB\fIn\fR\fR \fR
.ad
.sp .6
.RS 4n
Set the maximum number of IPCP terminate-request transmissions to \fIn\fR
(default 3).
.RE

.sp
.ne 2
.na
\fB\fBipcp-restart\fR \fB\fIn\fR\fR \fR
.ad
.sp .6
.RS 4n
Set the IPCP restart interval (retransmission timeout) to \fIn\fR seconds
(default 3).
.RE

.sp
.ne 2
.na
\fB\fBipparam\fR \fB\fIstring\fR\fR \fR
.ad
.sp .6
.RS 4n
Provides an extra parameter to the ip-up and ip-down scripts. When this option
is given, the \fIstring\fR supplied is given as the sixth parameter to those
scripts. See the  section.
.RE

.sp
.ne 2
.na
\fB\fBipv6\fR
\fB\fI<local_interface_identifier>\fR,\fI<remote_interface_identifier>\fR\fR
\fR
.ad
.sp .6
.RS 4n
Set the local and/or remote 64-bit interface identifier. Either one may be
omitted. The identifier must be specified in standard ASCII notation of IPv6
addresses (for example: \fB::dead:beef\fR). If the \fBipv6cp-use-ipaddr\fR
option is given, the local and remote identifiers are derived from the
respective IPv4 addresses (see above). The \fBipv6cp-use-persistent\fR option
can be used instead of the \fBipv6 <local>,<remote>\fR option.
.RE

.sp
.ne 2
.na
\fB\fBipv6cp-accept-local\fR \fR
.ad
.sp .6
.RS 4n
Accept peer's interface identifier for the local link identifier.
.RE

.sp
.ne 2
.na
\fB\fBipv6cp-max-configure\fR \fB\fIn\fR\fR \fR
.ad
.sp .6
.RS 4n
Set the maximum number of IPv6CP Configure-Request transmissions to \fIn\fR
(default 10).
.RE

.sp
.ne 2
.na
\fB\fBipv6cp-max-failure\fR \fB\fIn\fR\fR \fR
.ad
.sp .6
.RS 4n
Set the maximum number of IPv6CP Configure-NAKs sent before sending
Configure-Rejects instead to \fIn\fR (default 10).
.RE

.sp
.ne 2
.na
\fB\fBipv6cp-max-terminate\fR \fB\fIn\fR\fR \fR
.ad
.sp .6
.RS 4n
Set the maximum number of IPv6CP terminate-request transmissions to \fIn\fR
(default 3).
.RE

.sp
.ne 2
.na
\fB\fBipv6cp-restart\fR \fB\fIn\fR\fR \fR
.ad
.sp .6
.RS 4n
Set the IPv6CP restart interval (retransmission timeout) to \fIn\fR seconds
(default 3).
.RE

.sp
.ne 2
.na
\fB\fBipv6cp-use-ipaddr\fR \fR
.ad
.sp .6
.RS 4n
If either the local or remote IPv6 address is unspecified, use the
corresponding configured IPv4 address as a default interface identifier. (This
option uses the configured addresses, not the negotiated addresses. Do not use
it with \fBipcp-accept-local\fR if the local IPv6 identifier is unspecified or
with \fBipcp-accept-remote\fR if the remote IPv6 identifier is unspecified.)
.RE

.sp
.ne 2
.na
\fB\fBipv6cp-use-persistent\fR \fR
.ad
.sp .6
.RS 4n
Use uniquely-available persistent value for link local address.
.RE

.sp
.ne 2
.na
\fB\fBkdebug\fR \fB\fIn\fR\fR \fR
.ad
.sp .6
.RS 4n
Enable debugging code in the kernel-level PPP driver. Argument \fIn\fR is the
sum of the following values: \fB1\fR to enable general debug messages, \fB2\fR
to request that contents of received packets be printed, and \fB4\fR to request
contents of transmitted packets be printed. Messages printed by the kernel are
logged by \fBsyslogd\fR(1M) to a file directed in the \fB/etc/syslog.conf\fR
configuration file. Do not use the \fBkdebug\fR option to debug failed links.
Use the \fBdebug\fR option instead.
.RE

.sp
.ne 2
.na
\fB\fBlcp-echo-failure\fR \fB\fIn\fR\fR \fR
.ad
.sp .6
.RS 4n
If this option is given, \fBpppd\fR presumes the peer to be dead if \fIn\fR LCP
Echo-Requests are sent without receiving a valid LCP Echo-Reply. If this
happens, \fBpppd\fR terminates the connection. This option requires a non-zero
value for the \fBlcp-echo-interval\fR parameter. This option enables \fBpppd\fR
to terminate after the physical connection is broken (for example, if the modem
has hung up) in situations where no hardware modem control lines are available.
.RE

.sp
.ne 2
.na
\fB\fBlcp-echo-interval\fR \fB\fIn\fR\fR \fR
.ad
.sp .6
.RS 4n
If this option is given, \fBpppd\fR sends an LCP Echo-Request frame to the peer
every \fIn\fR seconds. Normally the peer responds to the Echo-Request by
sending an Echo-Reply. This option can be used with the \fBlcp-echo-failure\fR
option to detect that the peer is no longer connected.
.RE

.sp
.ne 2
.na
\fB\fBlcp-max-configure\fR \fB\fIn\fR\fR \fR
.ad
.sp .6
.RS 4n
Set the maximum number of LCP Configure-Request transmissions to \fIn\fR
(default 10).
.RE

.sp
.ne 2
.na
\fB\fBlcp-max-failure\fR \fB\fIn\fR\fR \fR
.ad
.sp .6
.RS 4n
Set the maximum number of LCP Configure-NAKs sent before starting to send
Configure-Rejects instead to \fIn\fR (default 10).
.RE

.sp
.ne 2
.na
\fB\fBlcp-max-terminate\fR \fB\fIn\fR\fR \fR
.ad
.sp .6
.RS 4n
Set the maximum number of LCP Terminate-Request transmissions to \fIn\fR
(default 3).
.RE

.sp
.ne 2
.na
\fB\fBlcp-restart\fR \fB\fIn\fR\fR \fR
.ad
.sp .6
.RS 4n
Set the LCP restart interval (retransmission timeout) to \fIn\fR seconds
(default 3).
.RE

.sp
.ne 2
.na
\fB\fBlinkname\fR \fB\fIname\fR\fR \fR
.ad
.sp .6
.RS 4n
Sets the logical name of the link to \fIname\fR. \fBpppd\fR creates a file
named \fBppp-\fR\fIname\fR\fB\&.pid\fR in \fB/var/run\fR containing its process
ID. This is useful in determining which instance of \fBpppd\fR is responsible
for the link to a given peer system. This is a privileged option.
.RE

.sp
.ne 2
.na
\fB\fBlocal\fR \fR
.ad
.sp .6
.RS 4n
Do not use modem control lines. With this option, \fBpppd\fR ignores the state
of the CD (Carrier Detect) signal from the modem and does not change the state
of the DTR (Data Terminal Ready) signal.
.RE

.sp
.ne 2
.na
\fB\fBlogfd\fR \fB\fIn\fR\fR \fR
.ad
.sp .6
.RS 4n
Send log messages to file descriptor \fIn\fR. \fBpppd\fR sends log messages to
(at most) one file or file descriptor (as well as sending the log messages to
syslog), so this option and the \fBlogfile\fR option are mutually exclusive. By
default \fBpppd\fR sends log messages to \fBstdout\fR (file descriptor 1)
unless the serial port is open on stdout.
.RE

.sp
.ne 2
.na
\fB\fBlogfile\fR \fB\fIfilename\fR\fR \fR
.ad
.sp .6
.RS 4n
Append log messages to the file \fIfilename\fR (and send the log messages to
syslog). The file is opened in append mode with the privileges of the user who
invoked \fBpppd\fR.
.RE

.sp
.ne 2
.na
\fB\fBlogin\fR \fR
.ad
.sp .6
.RS 4n
Use the system password database for authenticating the peer using PAP, and
record the user in the system \fBwtmp\fR file. Note that the peer must have an
entry in the \fB/etc/ppp/pap-secrets\fR file and the system password database
to be allowed access.
.RE

.sp
.ne 2
.na
\fB\fBmaxconnect\fR \fB\fIn\fR\fR \fR
.ad
.sp .6
.RS 4n
Terminate the connection after it has been available for network traffic for
\fIn\fR seconds (that is, \fIn\fR seconds after the first network control
protocol starts). An LCP Time-Remaining message is sent when the first NCP
starts, and again when 5, 2, and 0.5 minutes are remaining.
.RE

.sp
.ne 2
.na
\fB\fBmaxfail\fR \fB\fIn\fR\fR \fR
.ad
.sp .6
.RS 4n
Terminate after \fIn\fR consecutive failed connection attempts. A value of 0
means no limit. The default value is 10.
.RE

.sp
.ne 2
.na
\fB\fBmodem\fR \fR
.ad
.sp .6
.RS 4n
Use the modem control lines. This option is the default. With this option,
\fBpppd\fR waits for the CD (Carrier Detect) signal from the modem to be
asserted when opening the serial device (unless a connect script is specified),
and drops the DTR (Data Terminal Ready) signal briefly when the connection is
terminated and before executing the connect script.
.RE

.sp
.ne 2
.na
\fB\fBms-dns\fR \fB\fI<addr>\fR\fR \fR
.ad
.sp .6
.RS 4n
If \fBpppd\fR is acting as a server for Microsoft Windows clients, this option
allows \fBpppd\fR to supply one or two DNS (Domain Name Server) addresses to
the clients. The first instance of this option specifies the primary DNS
address; the second instance (if given) specifies the secondary DNS address. If
the first instance specifies a name that resolves to multiple IP addresses,
then the first two addresses are used. (This option is present in some older
versions of \fBpppd\fR under the name \fBdns-addr\fR.)
.RE

.sp
.ne 2
.na
\fB\fBms-lanman\fR \fR
.ad
.sp .6
.RS 4n
If \fBpppd\fR connects as a client to a Microsoft server and uses MS-CHAPv1 for
authentication, this option selects the LAN Manager password style instead of
Microsoft NT.
.RE

.sp
.ne 2
.na
\fB\fBms-wins\fR \fB\fI<addr>\fR\fR \fR
.ad
.sp .6
.RS 4n
If \fBpppd\fR acts as a server for Microsoft Windows or Samba clients, this
option allows \fBpppd\fR to supply one or two WINS (Windows Internet Name
Services) server addresses to the clients. The first instance of this option
specifies the primary WINS address; the second instance (if given) specifies
the secondary WINS address. As with \fBms-dns\fR, if the name specified
resolves to multiple IP addresses, then the first two will be taken as primary
and secondary.
.RE

.sp
.ne 2
.na
\fB\fBname\fR \fB\fIname\fR\fR \fR
.ad
.sp .6
.RS 4n
Set the name of the local system for authentication purposes to \fIname\fR.
This is a privileged option. With this option, \fBpppd\fR uses lines in the
secrets files that have \fIname\fR as the second field to look for a secret to
use in authenticating the peer. In addition, unless overridden with the
\fBuser\fR option, \fIname\fR is used as the name to send to the peer when
authenticating the local system. (Note that \fBpppd\fR does not append the
domain name to \fIname\fR.)
.RE

.sp
.ne 2
.na
\fB\fBno-accm-test\fR \fR
.ad
.sp .6
.RS 4n
Disable use of \fBasyncmap\fR (ACCM) checking using LCP Echo-Request messages.
If the \fBlcp-echo-failure\fR is used on an asynchronous line, \fBpppd\fR
includes all control characters in the first \fIn\fR LCP Echo-Request messages.
If the \fBasyncmap\fR is set incorrectly, the link drops rather than continue
operation with random failures. This option disables that feature.
.RE

.sp
.ne 2
.na
\fB\fBnoaccomp\fR \fR
.ad
.sp .6
.RS 4n
Disable HDLC Address/Control compression in both directions (send and receive).
.RE

.sp
.ne 2
.na
\fB\fBnoauth\fR \fR
.ad
.sp .6
.RS 4n
Do not require the peer to authenticate itself. This option is privileged.
.RE

.sp
.ne 2
.na
\fB\fBnobsdcomp\fR \fR
.ad
.sp .6
.RS 4n
Disables BSD-Compress compression; \fBpppd\fR will not request or agree to
compress packets using the BSD-Compress scheme. This option is not necessary if
\fBnoccp\fR is specified.
.RE

.sp
.ne 2
.na
\fB\fBnoccp\fR \fR
.ad
.sp .6
.RS 4n
Disable CCP (Compression Control Protocol) negotiation. This option should only
be required if the peer has bugs or becomes confused by requests from
\fBpppd\fR for CCP negotiation. If CCP is disabled, then BSD and deflate
compression do not need to be separately disabled.
.RE

.sp
.ne 2
.na
\fB\fBnocrtscts\fR \fR
.ad
.sp .6
.RS 4n
Disable hardware flow control (i.e. RTS/CTS) on the serial port. If the
\fBcrtscts\fR, \fBnocrtscts\fR, \fBcdtrcts\fR or \fBnocdtrcts\fR options are
not given, the hardware flow control setting for the serial port is left
unchanged.
.RE

.sp
.ne 2
.na
\fB\fBnocdtrcts\fR \fR
.ad
.sp .6
.RS 4n
This option is a synonym for \fBnocrtscts\fR. Either option will disable both
forms of hardware flow control.
.RE

.sp
.ne 2
.na
\fB\fBnodefaultroute\fR \fR
.ad
.sp .6
.RS 4n
Disable the \fBdefaultroute\fR option. You can prevent non-root users from
creating default routes with \fBpppd\fR by placing this option in the
\fB/etc/ppp/options\fR file.
.RE

.sp
.ne 2
.na
\fB\fBnodeflate\fR \fR
.ad
.sp .6
.RS 4n
Disables deflate compression; \fBpppd\fR will not request or agree to compress
packets using the deflate scheme. This option is not necessary if \fBnoccp\fR
is specified.
.RE

.sp
.ne 2
.na
\fB\fBnodeflatedraft\fR \fR
.ad
.sp .6
.RS 4n
Do not use Internet Draft (incorrectly assigned) algorithm number for deflate
compression. This option is not necessary if \fBnoccp\fR is specified.
.RE

.sp
.ne 2
.na
\fB\fBnodetach\fR \fR
.ad
.sp .6
.RS 4n
Do not detach from the controlling terminal. Without this option, \fBpppd\fR
forks to become a background process if a serial device other than the terminal
on the standard input is specified.
.RE

.sp
.ne 2
.na
\fB\fBnoendpoint\fR \fR
.ad
.sp .6
.RS 4n
Do not send or accept the Multilink Endpoint Discriminator option.
.RE

.sp
.ne 2
.na
\fB\fBnoident\fR \fR
.ad
.sp .6
.RS 4n
Disable use of LCP Identification. LCP Identification messages will not be sent
to the peer, but received messages will be logged. (Specify this option twice
to completely disable LCP Identification. In this case, \fBpppd\fR sends LCP
Code-Reject in response to received LCP Identification messages.)
.RE

.sp
.ne 2
.na
\fB\fBnoip\fR \fR
.ad
.sp .6
.RS 4n
Disable IPCP negotiation and IP communication. Use this option only if the peer
has bugs or becomes confused by requests from \fBpppd\fR for IPCP negotiation.
.RE

.sp
.ne 2
.na
\fB\fBnoipv6\fR \fR
.ad
.sp .6
.RS 4n
Disable IPv6CP negotiation and IPv6 communication. IPv6 is not enabled by
default.
.RE

.sp
.ne 2
.na
\fB\fBnoipdefault\fR \fR
.ad
.sp .6
.RS 4n
Disables the default behavior when no local IP address is specified, which is
to determine (if possible) the local IP address from the hostname. With this
option, the peer must supply the local IP address during IPCP negotiation
(unless it specified explicitly on the command line or in an options file).
.RE

.sp
.ne 2
.na
\fB\fBnolog\fR \fR
.ad
.sp .6
.RS 4n
Do not send log messages to a file or file descriptor. This option cancels the
\fBlogfd\fR and \fBlogfile\fR options. \fBnologfd\fR acts as an alias for this
option.
.RE

.sp
.ne 2
.na
\fB\fBnomagic\fR \fR
.ad
.sp .6
.RS 4n
Disable magic number negotiation. With this option, \fBpppd\fR cannot detect a
looped-back line. Use this option only if the peer has bugs. Do not use this
option to work around the "Serial line is looped back" error message.
.RE

.sp
.ne 2
.na
\fB\fBnopam\fR \fR
.ad
.sp .6
.RS 4n
This privileged option disables use of pluggable authentication modules. If
this option is specified, \fBpppd\fR reverts to standard authentication
mechanisms. The default is not to use PAM.
.RE

.sp
.ne 2
.na
\fB\fBnopcomp\fR \fR
.ad
.sp .6
.RS 4n
Disable protocol field compression negotiation in the receive and the transmit
direction.
.RE

.sp
.ne 2
.na
\fB\fBnopersist\fR \fR
.ad
.sp .6
.RS 4n
Exit once a connection has been made and terminated. This is the default unless
the \fBpersist\fR or \fBdemand\fR option is specified.
.RE

.sp
.ne 2
.na
\fB\fBnoplink\fR \fR
.ad
.sp .6
.RS 4n
Cause \fBpppd\fR to use I_LINK instead of I_PLINK. This is the default. When
I_LINK is used, the system cleans up terminated interfaces (even when SIGKILL
is used) but does not allow \fBifconfig\fR(1M) to unplumb PPP streams or insert
or remove modules dynamically. Use the \fBplink\fR option if \fBifconfig\fR(1M)
modinsert, modremove or unplumb support is needed.
.RE

.sp
.ne 2
.na
\fB\fBnopredictor1\fR \fR
.ad
.sp .6
.RS 4n
Do not accept or agree to Predictor-1 compression. (This option is accepted for
compatibility. The implementation does not support Predictor-1 compression.)
.RE

.sp
.ne 2
.na
\fB\fBnoproxyarp\fR \fR
.ad
.sp .6
.RS 4n
Disable the \fBproxyarp\fR option. If you want to prevent users from creating
proxy ARP entries with \fBpppd\fR, place this option in the
\fB/etc/ppp/options\fR file.
.RE

.sp
.ne 2
.na
\fB\fBnotty\fR \fR
.ad
.sp .6
.RS 4n
Normally, \fBpppd\fR requires a terminal device. With this option, \fBpppd\fR
allocates itself a pseudo-tty master/slave pair and uses the slave as its
terminal device. \fBpppd\fR creates a child process to act as a character shunt
to transfer characters between the pseudo-tty master and its standard input and
output. Thus, \fBpppd\fR transmits characters on its standard output and
receives characters on its standard input even if they are not terminal
devices. This option increases the latency and CPU overhead of transferring
data over the ppp interface as all of the characters sent and received must
flow through the character shunt process. An explicit device name may not be
given if this option is used.
.RE

.sp
.ne 2
.na
\fB\fBnovj\fR \fR
.ad
.sp .6
.RS 4n
Disable Van Jacobson style TCP/IP header compression in both the transmit and
the receive direction.
.RE

.sp
.ne 2
.na
\fB\fBnovjccomp\fR \fR
.ad
.sp .6
.RS 4n
Disable the connection-ID compression option in Van Jacobson style TCP/IP
header compression. With this option, \fBpppd\fR does not omit the
connection-ID byte from Van Jacobson compressed TCP/IP headers, nor does it ask
the peer to do so. This option is unnecessary if \fBnovj\fR is specified.
.RE

.sp
.ne 2
.na
\fB\fBpam\fR \fR
.ad
.sp .6
.RS 4n
This privileged option enables use of PAM. If this is specified, \fBpppd\fR
uses the \fBpam\fR(3PAM) framework for user authentication with a service name
of "ppp" if the \fBlogin\fR option and PAP authentication are used. The default
is not to use PAM.
.RE

.sp
.ne 2
.na
\fB\fBpapcrypt\fR \fR
.ad
.sp .6
.RS 4n
Indicates that \fBpppd\fR should not accept a password which, before
encryption, is identical to the secret from the \fB/etc/ppp/pap-secrets\fR
file. Use this option if the secrets in the \fBpap-secrets\fR file are in
\fBcrypt\fR(3C) format.
.RE

.sp
.ne 2
.na
\fB\fBpap-max-authreq\fR \fB\fIn\fR\fR \fR
.ad
.sp .6
.RS 4n
Set the maximum number of PAP authenticate-request transmissions to \fIn\fR
(default 10).
.RE

.sp
.ne 2
.na
\fB\fBpap-restart\fR \fB\fIn\fR\fR \fR
.ad
.sp .6
.RS 4n
Set the PAP restart interval (retransmission timeout) to \fIn\fR seconds
(default 3).
.RE

.sp
.ne 2
.na
\fB\fBpap-timeout\fR \fB\fIn\fR\fR \fR
.ad
.sp .6
.RS 4n
Set the maximum time that \fBpppd\fR waits for the peer to authenticate itself
with PAP to \fIn\fR seconds (0= no limit). The default is 30 seconds.
.RE

.sp
.ne 2
.na
\fB\fBpassword\fR \fB\fIstring\fR\fR \fR
.ad
.sp .6
.RS 4n
Password string for authentication to the peer.
.RE

.sp
.ne 2
.na
\fB\fBpersist\fR \fR
.ad
.sp .6
.RS 4n
Do not exit after a connection is terminated; instead try to reopen the
connection.
.RE

.sp
.ne 2
.na
\fB\fBplink\fR \fR
.ad
.sp .6
.RS 4n
Cause \fBpppd\fR to use I_PLINK instead of I_LINK. The default is to use
I_LINK, which cleans up terminated interface (even if SIGKILL is used), but
does not allow \fBifconfig\fR(1M) to unplumb PPP streams or insert or remove
modules dynamically. Use this option if \fBifconfig\fR(1M)
modinsert/modremove/unplumb support is needed. See also the \fBplumbed\fR
option.
.RE

.sp
.ne 2
.na
\fB\fBplugin\fR \fB\fIfilename\fR\fR \fR
.ad
.sp .6
.RS 4n
Load the shared library object file \fIfilename\fR as a plugin. This is a
privileged option. Unless the filename specifies an explicit path,
\fB/etc/ppp/plugins\fR and \fB/usr/lib/inet/ppp\fR will be searched for the
object to load in that order.
.RE

.sp
.ne 2
.na
\fB\fBplumbed\fR \fR
.ad
.sp .6
.RS 4n
This option indicates that \fBpppd\fR should find a plumbed interface and use
that for the session. If IPv4 addresses or IPv6 interface IDs or link MTU are
otherwise unspecified, they are copied from the interface selected. This mode
mimics some of the functionality of the older \fBaspppd\fR implementation and
may be helpful when \fBpppd\fR is used with external applications that use
\fBifconfig\fR(1M).
.RE

.sp
.ne 2
.na
\fB\fBpppmux\fR \fB\fItimer\fR\fR \fR
.ad
.sp .6
.RS 4n
Enable PPP Multiplexing option negotiation and set transmit multiplexing
timeout to \fItimer\fR microseconds.
.RE

.sp
.ne 2
.na
\fB\fBprivgroup\fR \fB\fIgroup-name\fR\fR \fR
.ad
.sp .6
.RS 4n
Allows members of group \fIgroup-name\fR to use privileged options. This is a
privileged option. Because there is no guarantee that members of
\fIgroup-name\fR cannot use \fBpppd\fR to become root themselves, you should be
careful using this option. Consider it equivalent to putting the members of
\fIgroup-name\fR in the \fBroot\fR or \fBsys\fR group.
.RE

.sp
.ne 2
.na
\fB\fBproxyarp\fR \fR
.ad
.sp .6
.RS 4n
Add an entry to the system's Address Resolution Protocol (ARP) table with the
IP address of the peer and the Ethernet address of this system. When you use
this option, the peer appears to other systems to be on the local Ethernet. The
remote address on the PPP link must be in the same subnet as assigned to an
Ethernet interface.
.RE

.sp
.ne 2
.na
\fB\fBpty\fR \fB \fIscript\fR\fR \fR
.ad
.sp .6
.RS 4n
Specifies that the command \fIscript\fR, and not a specific terminal device is
used for serial communication. \fBpppd\fR allocates itself a pseudo-tty
master/slave pair and uses the slave as its terminal device. \fIscript\fR runs
in a child process with the pseudo-tty master as its standard input and output.
An explicit device name may not be given if this option is used. (Note: if the
\fBrecord\fR option is used in conjunction with the \fBpty\fR option, the child
process will have pipes on its standard input and output.)
.RE

.sp
.ne 2
.na
\fB\fBreceive-all\fR \fR
.ad
.sp .6
.RS 4n
With this option, \fBpppd\fR accepts all control characters from the peer,
including those marked in the receive \fBasyncmap\fR. Without this option,
\fBpppd\fR discards those characters as specified in \fIRFC 1662\fR. This
option should be used only if the peer has bugs, as is often found with
dial-back implementations.
.RE

.sp
.ne 2
.na
\fB\fBrecord\fR \fB\fIfilename\fR\fR \fR
.ad
.sp .6
.RS 4n
Directs \fBpppd\fR to record all characters sent and received to a file named
\fIfilename\fR. \fIfilename\fR is opened in append mode, using the user's
user-ID and permissions. Because this option uses a pseudo-tty and a process to
transfer characters between the pseudo-tty and the real serial device, it
increases the latency and CPU overhead of transferring data over the PPP
interface. Characters are stored in a tagged format with timestamps that can be
displayed in readable form using the \fBpppdump\fR(1M) program. This option is
generally used when debugging the kernel portion of \fBpppd\fR (especially CCP
compression algorithms) and not for debugging link configuration problems. See
the \fBdebug\fR option.
.RE

.sp
.ne 2
.na
\fB\fBremotename\fR \fB\fIname\fR\fR \fR
.ad
.sp .6
.RS 4n
Set the assumed name of the remote system for authentication purposes to
\fIname\fR. Microsoft WindowsNT does not provide a system name in its CHAP
Challenge messages, and this option is often used to work around this problem.
.RE

.sp
.ne 2
.na
\fB\fBrefuse-chap\fR \fR
.ad
.sp .6
.RS 4n
With this option, \fBpppd\fR will not agree to authenticate itself to the peer
using standard Challenge Handshake Authentication Protocol (CHAP). (MS-CHAP is
not affected.)
.RE

.sp
.ne 2
.na
\fB\fBrefuse-mschap\fR \fR
.ad
.sp .6
.RS 4n
Do not agree to authenticate to peer with MS-CHAPv1. If this option is
specified, requests for MS-CHAPv1 authentication from the peer are declined
with LCP Configure-Nak. That option does not disable any other form of CHAP.
.RE

.sp
.ne 2
.na
\fB\fBrefuse-mschapv2\fR \fR
.ad
.sp .6
.RS 4n
Do not agree to authenticate to peer with MS-CHAPv2. If specified, this option
requests that MS-CHAPv2 authentication from the peer be declined with LCP
Configure-Nak. That option does not disable any other form of CHAP.
.RE

.sp
.ne 2
.na
\fB\fBrefuse-pap\fR \fR
.ad
.sp .6
.RS 4n
With this option, \fBpppd\fR will not agree to authenticate itself to the peer
using Password Authentication Protocol (PAP).
.RE

.sp
.ne 2
.na
\fB\fBrequire-chap\fR \fR
.ad
.sp .6
.RS 4n
Require the peer to authenticate itself using standard CHAP authentication.
MS-CHAP is not affected.
.RE

.sp
.ne 2
.na
\fB\fBrequire-mschap\fR \fR
.ad
.sp .6
.RS 4n
Require the peer to authenticate itself using MS-CHAPv1 authentication.
.RE

.sp
.ne 2
.na
\fB\fBrequire-mschapv2\fR \fR
.ad
.sp .6
.RS 4n
Require the peer to authenticate itself using MS-CHAPv2 authentication.
.RE

.sp
.ne 2
.na
\fB\fBrequire-pap\fR \fR
.ad
.sp .6
.RS 4n
Require the peer to authenticate itself using PAP authentication.
.RE

.sp
.ne 2
.na
\fB\fBshow-password\fR \fR
.ad
.sp .6
.RS 4n
When logging contents of PAP packets, this option causes \fBpppd\fR to show the
password string in the log message.
.RE

.sp
.ne 2
.na
\fB\fBsilent\fR \fR
.ad
.sp .6
.RS 4n
With this option, \fBpppd\fR will not transmit LCP packets to initiate a
connection until a valid LCP packet is received from the peer. This is like the
"passive" option with older versions of \fBpppd\fR and is retained for
compatibility, but the current \fBpassive\fR option is preferred.
.RE

.sp
.ne 2
.na
\fB\fBsmall-accm-test\fR \fR
.ad
.sp .6
.RS 4n
When checking the \fBasyncmap\fR (ACCM) setting, \fBpppd\fR uses all 256
possible values by default. See \fBno-accm-test\fR. This option restricts the
test so that only the 32 values affected by standard ACCM negotiation are
tested. This option is useful on very slow links.
.RE

.sp
.ne 2
.na
\fB\fBsocket\fR \fB\fIhost\fR:\fIport\fR\fR \fR
.ad
.sp .6
.RS 4n
Connect to given host and port using TCP and run PPP over this connection.
.RE

.sp
.ne 2
.na
\fB\fBsync\fR \fR
.ad
.sp .6
.RS 4n
Use synchronous HDLC serial encoding instead of asynchronous. The device used
by \fBpppd\fR with this option must have sync support. Currently supports
\fBzs\fR, \fBse\fR, and \fBhsi\fR drivers.
.RE

.sp
.ne 2
.na
\fB\fBunit\fR \fB\fIn\fR\fR \fR
.ad
.sp .6
.RS 4n
Set PPP interface unit number to \fIn\fR, if possible.
.RE

.sp
.ne 2
.na
\fB\fBupdetach\fR \fR
.ad
.sp .6
.RS 4n
With this option, \fBpppd\fR detaches from its controlling terminal after
establishing the PPP connection. When this is specified, messages sent to
\fBstderr\fR by the connect script, usually \fBchat\fR(1M), and debugging
messages from the debug option are directed to \fBpppd\fR's standard output.
.RE

.sp
.ne 2
.na
\fB\fBusehostname\fR \fR
.ad
.sp .6
.RS 4n
Enforce the use of the hostname with domain name appended, if given, as the
name of the local system for authentication purposes. This overrides the
\fBname\fR option. Because the \fBname\fR option is privileged, this option is
normally not needed.
.RE

.sp
.ne 2
.na
\fB\fBusepeerdns\fR \fR
.ad
.sp .6
.RS 4n
Ask the peer for up to two DNS server addresses. Addresses supplied by the
peer, if any, are passed to the \fB/etc/ppp/ip-up\fR script in the environment
variables DNS1 and DNS2. In addition, \fBpppd\fR creates an
\fB/etc/ppp/resolv.conf\fR file containing one or two nameserver lines with the
address(es) supplied by the peer.
.RE

.sp
.ne 2
.na
\fB\fBuser\fR \fB\fIname\fR\fR \fR
.ad
.sp .6
.RS 4n
Sets the name used for authenticating the local system to the peer to
\fIname\fR.
.RE

.sp
.ne 2
.na
\fB\fBvj-max-slots\fR \fB\fIn\fR\fR \fR
.ad
.sp .6
.RS 4n
Sets the number of connection slots to be used by the Van Jacobson TCP/IP
header compression and decompression code to \fIn\fR, which must be between 2
and 16 (inclusive).
.RE

.sp
.ne 2
.na
\fB\fBwelcome\fR \fB\fIscript\fR\fR \fR
.ad
.sp .6
.RS 4n
Run the executable or shell command specified by \fIscript\fR before initiating
PPP negotiation, after the connect script, if any, has completed. A value for
this option from a privileged source cannot be overridden by a non-privileged
user.
.RE

.sp
.ne 2
.na
\fB\fBxonxoff\fR \fR
.ad
.sp .6
.RS 4n
Use software flow control, that is, XON/XOFF, to control the flow of data on
the serial port.
.RE

.SS "Obsolete Options"
.sp
.LP
The following options are obsolete:
.sp
.ne 2
.na
\fB\fB+ua\fR \fB\fIname\fR\fR\fR
.ad
.RS 14n
Read a PAP user name and password from the file \fIname\fR. This file must have
two lines for name and password. Name and password are sent to the peer when
the peer requests PAP authentication.
.RE

.sp
.ne 2
.na
\fB\fB+ipv6\fR \fR
.ad
.RS 14n
Enable IPv6 and IPv6CP without specifying interface identifiers.
.RE

.sp
.ne 2
.na
\fB\fB--version\fR \fR
.ad
.RS 14n
Show version number and exit.
.RE

.sp
.ne 2
.na
\fB\fB--help\fR \fR
.ad
.RS 14n
Show brief help message and exit.
.RE

.SH EXTENDED DESCRIPTION
.sp
.LP
The following sections discuss miscellaneous features of \fBpppd\fR:
.SS "Security"
.sp
.LP
\fBpppd\fR allows system administrators to provide legitimate users with PPP
access to a server machine without fear of compromising the security of the
server or the network it runs on. Access control is provided by restricting IP
addresses the peer may use based on its authenticated identity (if any), and
through restrictions on options a non-privileged user may use. Options that
permit potentially insecure configurations are privileged. Privileged options
are accepted only in files that are under the control of the system
administrator or when \fBpppd\fR is being run by root.
.sp
.LP
By default, \fBpppd\fR allows an unauthenticated peer to use a given IP address
only if the system does not already have a route to that IP address. For
example, a system with a permanent connection to the wider Internet will
normally have a default route, meaning all peers must authenticate themselves
to set up a connection. On such a system, the \fBauth\fR option is the default.
Conversely, a system with a PPP link that comprises the only connection to the
Internet probably does not possess a default route, so the peer can use
virtually any IP address without authenticating itself.
.sp
.LP
Security-sensitive options are privileged and cannot be accessed by a
non-privileged user running \fBpppd\fR, either on the command line, in the
user's \fB$HOME/.ppprc\fR file, or in an options file read using the \fBfile\fR
option. Privileged options may be used in \fB/etc/ppp/options\fR file or in an
options file read using the \fBcall\fR option. If \fBpppd\fR is run by the root
user, privileged options can be used without restriction. If the
\fB/etc/ppp/options\fR file does not exist, then only root may invoke
\fBpppd\fR. The \fB/etc/ppp/options\fR file must be created (but may be empty)
to allow ordinary non-root users to access \fBpppd\fR.
.sp
.LP
When opening the device, \fBpppd\fR uses the invoking user's user ID or the
root UID (that is, 0), depending if the device name was specified by the user
or the system administrator. If the device name comes from a privileged source,
that is, \fB/etc/ppp/options\fR or an options file read using the \fBcall\fR
option, \fBpppd\fR uses full root privileges when opening the device. Thus, by
creating an appropriate file under \fB/etc/ppp/peers\fR, the system
administrator can allow users to establish a PPP connection via a device that
they would not normally have access to. Otherwise \fBpppd\fR uses the invoking
user's real UID when opening the device.
.SS "Authentication"
.sp
.LP
During the authentication process, one peer convinces the other of its identity
by sending its name and some secret information to the other. During
authentication, the first peer becomes the "client" and the second becomes the
"server." Authentication names can (but are not required to) correspond to the
peer's Internet hostnames.
.sp
.LP
\fBpppd\fR supports four authentication protocols: the Password Authentication
Protocol (PAP) and three forms of the Challenge Handshake Authentication
Protocol (CHAP). With the PAP protocol, the client sends its name and a
cleartext password to the server to authenticate itself. With CHAP, the server
initiates the authentication exchange by sending a challenge to the client who
must respond with its name and a hash value derived from the shared secret and
the challenge.
.sp
.LP
The PPP protocol is symmetrical, meaning that each peer may be required to
authenticate itself to the other. Different authentication protocols and names
can be used for each exchange.
.sp
.LP
By default, \fBpppd\fR authenticates if requested and does not require
authentication from the peer. However, \fBpppd\fR does not authenticate itself
with a specific protocol if it has no secrets that can do so.
.sp
.LP
\fBpppd\fR stores authentication secrets in the \fB/etc/ppp/pap-secrets\fR (for
PAP), and \fB/etc/ppp/chap-secrets\fR (for CHAP) files. Both files use the same
format. \fBpppd\fR uses secrets files to authenticate itself to other systems
and to authenticate other systems to itself.
.sp
.LP
Secrets files contain one secret per line. Secrets are specific to a particular
combination of client and server and can only be used by that client to
authenticate itself to that server. Each line in a secrets file has a minimum
of three fields that contain the client and server names followed by the
secret. Often, these three fields are followed by IP addresses that are used by
clients to connect to a server.
.sp
.LP
A secrets file is parsed into words, with client name, server name and secrets
fields allocated one word each. Embedded spaces or other special characters
within a word must be quoted or escaped. Case is significant in all three
fields.
.sp
.LP
A secret beginning with an at sign ("@") is followed by the name of a file
containing the secret. An asterisk (*) as the client or server name matches any
name. When choosing a match, \fBpppd\fR selects the one with the fewest
wildcards. Succeeding words on a line are interpreted by \fBpppd\fR as
acceptable IP addresses for that client. IP Addresses are disallowed if they
appear in lines that contain only three words or lines whose first word begins
with a hyphen ("-"). To allow any address, use "*". An address starting with an
exclamation point ("!") indicates that the specified address is not acceptable.
An address may be followed by "/" and a number \fIn\fR to indicate a whole
subnet (all addresses that have the same value in the most significant \fIn\fR
bits). In this form, the address may be followed by a plus sign ("+") to
indicate that one address from the subnet is authorized, based on the ppp
network interface unit number in use. In this case, the host part of the
address is set to the unit number, plus one.
.sp
.LP
When authenticating the peer, \fBpppd\fR chooses a secret with the peer's name
in the first field of the secrets file and the name of the local system in the
second field. The local system name defaults to the hostname, with the domain
name appended if the \fBdomain\fR option is used. The default can be overridden
with the \fBname\fR option unless the \fBusehostname\fR option is used.
.sp
.LP
When authenticating to the peer, \fBpppd\fR first determines the name it will
use to identify itself to the peer. This name is specified with the \fBuser\fR
option. If the \fBuser\fR option is not used, the name defaults to the host
name of the local system. \fBpppd\fR then selects a secret from the secrets
file by searching for an entry with a local name in the first field and the
peer's name in the second field. \fBpppd\fR will know the name of the peer if
standard CHAP authentication is used because the peer will have sent it in the
Challenge packet. However, if MS-CHAP or PAP is being used, \fBpppd\fR must
determine the peer's name from the options specified by the user. The user can
specify the peer's name directly with the \fBremotename\fR option. Otherwise,
if the remote IP address was specified by a name, rather than in numeric form,
that name will be used as the peer's name. If that fails, \fBpppd\fR uses the
null string as the peer's name.
.sp
.LP
When authenticating the peer with PAP, the supplied password is compared with
data in the secrets file. If the password and secret do not match, the password
is encrypted using \fBcrypt()\fR and checked against the secret again. If the
\fBpapcrypt\fR option is given, the first unencrypted comparison is omitted for
better security, and entries must thus be in encrypted \fBcrypt\fR(3C) form.
.sp
.LP
If the \fBlogin\fR option is specified, the username and password are also
checked against the system password database. This allows you to set up the
\fBpap-secrets\fR file to enable PPP access only to certain users, and to
restrict the set of IP addresses available to users. Typically, when using the
\fBlogin\fR option, the secret in \fB/etc/ppp/pap-secrets\fR would be "", which
matches any password supplied by the peer. This makes having the same secret in
two places unnecessary. When \fBlogin\fR is used, the \fBpam\fR option enables
access control through \fBpam\fR(3PAM).
.sp
.LP
Authentication must be completed before IPCP (or other network protocol) can be
started. If the peer is required to authenticate itself and fails, \fBpppd\fR
closes LCP and terminates the link. If IPCP negotiates an unacceptable IP
address for the remote host, IPCP is closed. IP packets are sent or received
only when IPCP is open.
.sp
.LP
To allow hosts that cannot authenticate themselves to connect and use one of a
restricted set of IP addresses, add a line to the \fBpap-secrets\fR file
specifying the empty string for the client name and secret.
.sp
.LP
Additional \fBpppd\fR options for a given peer may be specified by placing them
at the end of the secrets entry, separated by two dashes (--). For example
.sp
.in +2
.nf
peername servername secret ip-address -- novj
.fi
.in -2

.SS "Routing"
.sp
.LP
When IPCP negotiation is complete, \fBpppd\fR informs the kernel of the local
and remote IP addresses for the PPP interface and creates a host route to the
remote end of the link that enables peers to exchange IP packets. Communication
with other machines generally requires further modification to routing tables
and/or Address Resolution Protocol (ARP) tables. In most cases the
\fBdefaultroute\fR and/or \fBproxyarp\fR options are sufficient for this, but
further intervention may be necessary. If further intervention is required, use
the \fB/etc/ppp/ip-up\fR script or a routing protocol daemon.
.sp
.LP
To add a default route through the remote host, use the \fBdefaultroute\fR
option. This option is typically used for "client" systems; that is, end-nodes
that use the PPP link for access to the general Internet.
.sp
.LP
In some cases it is desirable to use proxy ARP, for example on a server machine
connected to a LAN, to allow other hosts to communicate with the remote host.
\fBproxyarp\fR instructs \fBpppd\fR to look for a network interface on the same
subnet as the remote host. That is, an interface supporting broadcast and ARP
that is not a point-to-point or loopback interface and that is currently up. If
found, \fBpppd\fR creates a permanent, published ARP entry with the IP address
of the remote host and the hardware address of the network interface.
.sp
.LP
When the \fBdemand\fR option is used, the interface IP addresses are already
set at the time when IPCP comes up. If \fBpppd\fR cannot negotiate the same
addresses it used to configure the interface, it changes the interface IP
addresses to the negotiated addresses. This may disrupt existing connections.
Using demand dialing with peers that perform dynamic IP address assignment is
not recommended.
.SS "Scripts"
.sp
.LP
\fBpppd\fR invokes scripts at various stages during processing that are used to
perform site-specific ancillary processing. These scripts may be shell scripts
or executable programs. \fBpppd\fR does not wait for the scripts to finish. The
scripts are executed as \fBroot\fR (with the real and effective user-id set to
0), enabling them to update routing tables, run privileged daemons, or perform
other tasks. Be sure that the contents of these scripts do not compromise your
system's security. \fBpppd\fR runs the scripts with standard input, output and
error redirected to \fB/dev/null\fR, and with an environment that is empty
except for some environment variables that give information about the link. The
\fBpppd\fR environment variables are:
.sp
.ne 2
.na
\fB\fBDEVICE\fR \fR
.ad
.RS 15n
Name of the serial tty device.
.RE

.sp
.ne 2
.na
\fB\fBIFNAME\fR \fR
.ad
.RS 15n
Name of the network interface.
.RE

.sp
.ne 2
.na
\fB\fBIPLOCAL\fR \fR
.ad
.RS 15n
IP address for the link's local end. This is set only when IPCP has started.
.RE

.sp
.ne 2
.na
\fB\fBIPREMOTE\fR \fR
.ad
.RS 15n
IP address for the link's remote end. This is set only when IPCP has started.
.RE

.sp
.ne 2
.na
\fB\fBPEERNAME\fR \fR
.ad
.RS 15n
Authenticated name of the peer. This is set only if the peer authenticates
itself.
.RE

.sp
.ne 2
.na
\fB\fBSPEED\fR \fR
.ad
.RS 15n
Baud rate of the tty device.
.RE

.sp
.ne 2
.na
\fB\fBORIG_UID\fR \fR
.ad
.RS 15n
Real user-id of user who invoked \fBpppd\fR.
.RE

.sp
.ne 2
.na
\fB\fBPPPLOGNAME\fR \fR
.ad
.RS 15n
Username of the real user-id who invoked \fBpppd\fR. This is always set.
.RE

.sp
.LP
\fBpppd\fR also sets the following variables for the ip-down and auth-down
scripts:
.sp
.ne 2
.na
\fB\fBCONNECT_TIME\fR \fR
.ad
.RS 17n
Number of seconds between the start of PPP negotiation and connection
termination.
.RE

.sp
.ne 2
.na
\fB\fBBYTES_SENT\fR \fR
.ad
.RS 17n
Number of bytes sent at the level of the serial port during the connection.
.RE

.sp
.ne 2
.na
\fB\fBBYTES_RCVD\fR \fR
.ad
.RS 17n
Number of bytes received at the level of the serial port during the connection.
.RE

.sp
.ne 2
.na
\fB\fBLINKNAME\fR \fR
.ad
.RS 17n
Logical name of the link, set with the \fBlinkname\fR option.
.RE

.sp
.LP
If they exist, \fBpppd\fR invokes the following scripts. It is not an error if
they do not exist.
.sp
.ne 2
.na
\fB\fB/etc/ppp/auth-up\fR \fR
.ad
.RS 23n
Program or script executed after the remote system successfully authenticates
itself. It is executed with five command-line arguments: \fBinterface-name
peer-name user-name tty-device speed\fR. Note that this script is not executed
if the peer does not authenticate itself, for example, when the \fBnoauth\fR
option is used.
.RE

.sp
.ne 2
.na
\fB\fB/etc/ppp/auth-down\fR \fR
.ad
.RS 23n
Program or script executed when the link goes down if \fB/etc/ppp/auth-up\fR
was previously executed. It is executed in the same manner with the same
parameters as \fB/etc/ppp/auth-up\fR.
.RE

.sp
.ne 2
.na
\fB\fB/etc/ppp/ip-up\fR \fR
.ad
.RS 21n
A program or script that is executed when the link is available for sending and
receiving IP packets (that is, IPCP has come up). It is executed with six
command-line arguments: \fBinterface-name tty-device speed local-IP-address
remote-IP-address ipparam\fR.
.RE

.sp
.ne 2
.na
\fB\fB/etc/ppp/ip-down\fR \fR
.ad
.RS 21n
A program or script which is executed when the link is no longer available for
sending and receiving IP packets. This script can be used for undoing the
effects of the \fB/etc/ppp/ip-up\fR script. It is invoked in the same manner
and with the same parameters as the \fBip-up\fR script.
.RE

.sp
.ne 2
.na
\fB\fB/etc/ppp/ipv6-up\fR \fR
.ad
.RS 21n
Similar to \fB/etc/ppp/ip-up\fR, except that it is executed when the link is
available for sending and receiving IPv6 packets. Executed with six
command-line arguments: \fBinterface-name tty-device speed
local-link-local-address remote-link-local-address ipparam\fR.
.RE

.sp
.ne 2
.na
\fB\fB/etc/ppp/ipv6-down\fR \fR
.ad
.RS 23n
Similar to \fB/etc/ppp/ip-down\fR, but executed when IPv6 packets can no longer
be transmitted on the link. Executed with the same parameters as the ipv6-up
script.
.RE

.SH EXAMPLES
.LP
\fBExample 1 \fRUsing the \fBauth\fR Option
.sp
.LP
The following examples assume that the \fB/etc/ppp/options\fR file contains the
\fBauth\fR option.

.sp
.LP
\fBpppd\fR is commonly used to dial out to an ISP. You can do this using the
"\fBpppd call isp\fR" command where the \fB/etc/ppp/peers/isp\fR file is set up
to contain a line similar to the following:

.sp
.in +2
.nf
cua/a 19200 crtscts connect '/usr/bin/chat -f /etc/ppp/chat-isp' noauth
.fi
.in -2

.sp
.LP
For this example, \fBchat\fR(1M) is used to dial the ISP's modem and process
any login sequence required. The \fB/etc/ppp/chat-isp\fR file is used by
\fBchat\fR and could contain the following:

.sp
.in +2
.nf
ABORT "NO CARRIER"
ABORT "NO DIALTONE"
ABORT "ERROR"
ABORT "NO ANSWER"
ABORT "BUSY"
ABORT "Username/Password Incorrect"
"" "at"
OK "at&f&d2&c1"
OK "atdt2468135"
"name:" "^Umyuserid"
"word:" "\qmypassword"
"ispts" "\q^Uppp"
"~-^Uppp-~"
.fi
.in -2

.sp
.LP
See the \fBchat\fR(1M) man page for details of \fBchat\fR scripts.

.LP
\fBExample 2 \fRUsing \fBpppd\fR with \fBproxyarp\fR
.sp
.LP
\fBpppd\fR can also provide a dial-in ppp service for users. If the users
already have login accounts, the simplest way to set up the ppp service is to
let the users log in to their accounts and run \fBpppd\fR as shown in the
following example:

.sp
.in +2
.nf
example% \fBpppd proxyarp\fR
.fi
.in -2
.sp

.LP
\fBExample 3 \fRProviding a User with Access to PPP Facilities
.sp
.LP
To provide a user with access to the PPP facilities, allocate an IP address for
the user's machine, create an entry in \fB/etc/ppp/pap-secrets\fR or
\fB/etc/ppp/chap-secrets\fR. This enables the user's machine to authenticate
itself. For example, to enable user "Joe" using machine "joespc" to dial in to
machine "server" and use the IP address "joespc.my.net," add the following
entry to the \fB/etc/ppp/pap-secrets\fR or \fB/etc/ppp/chap-secrets\fR files:

.sp
.in +2
.nf
\fBjoespc	server	"joe's secret"	joespc.my.net\fR
.fi
.in -2
.sp

.sp
.LP
Alternatively, you can create another username, for example "ppp," whose login
shell is \fB/usr/bin/pppd\fR and whose home directory is \fB/etc/ppp\fR. If you
run \fBpppd\fR this way, add the options to the \fB/etc/ppp/.ppprc\fR file.

.sp
.LP
If your serial connection is complex, it may be useful to escape such control
characters as XON (^Q) and XOFF (^S), using \fBasyncmap a0000\fR. If the path
includes a telnet, escape ^] (\fBasyncmap 200a0000\fR). If the path includes a
\fBrlogin\fR command, add \fBescape ff\fR option to the options, because
\fBrlogin\fR removes the window-size-change sequence [0xff, 0xff, 0x73, 0x73,
followed by any 8 bytes] from the stream.

.SH EXIT STATUS
.sp
.LP
The \fBpppd\fR exit status indicates errors or specifies why a link was
terminated. Exit status values are:
.sp
.ne 2
.na
\fB\fB0\fR \fR
.ad
.RS 7n
\fBpppd\fR has detached or the connection was successfully established and
terminated at the peer's request.
.RE

.sp
.ne 2
.na
\fB\fB1\fR \fR
.ad
.RS 7n
An immediately fatal error occurred. For example, an essential system call
failed.
.RE

.sp
.ne 2
.na
\fB\fB2\fR \fR
.ad
.RS 7n
An error was detected in the options given. For example, two mutually exclusive
options were used, or \fB/etc/ppp/options\fR is missing and the user is not
root.
.RE

.sp
.ne 2
.na
\fB\fB3\fR \fR
.ad
.RS 7n
\fBpppd\fR is not \fBsetuid-root\fR and the invoking user is not root.
.RE

.sp
.ne 2
.na
\fB\fB4\fR \fR
.ad
.RS 7n
The kernel does not support PPP. For example, the PPP kernel driver is not
included or cannot be loaded.
.RE

.sp
.ne 2
.na
\fB\fB5\fR \fR
.ad
.RS 7n
\fBpppd\fR terminated because it was sent a SIGINT, SIGTERM or SIGHUP signal.
.RE

.sp
.ne 2
.na
\fB\fB6\fR \fR
.ad
.RS 7n
The serial port could not be locked.
.RE

.sp
.ne 2
.na
\fB\fB7\fR \fR
.ad
.RS 7n
The serial port could not be opened.
.RE

.sp
.ne 2
.na
\fB\fB8\fR \fR
.ad
.RS 7n
The connect script failed and returned a non-zero exit status.
.RE

.sp
.ne 2
.na
\fB\fB9\fR \fR
.ad
.RS 7n
The command specified as the argument to the \fBpty\fR option could not be run.
.RE

.sp
.ne 2
.na
\fB\fB10\fR \fR
.ad
.RS 7n
The PPP negotiation failed because no network protocols were able to run.
.RE

.sp
.ne 2
.na
\fB\fB11\fR \fR
.ad
.RS 7n
The peer system failed or refused to authenticate itself.
.RE

.sp
.ne 2
.na
\fB\fB12\fR \fR
.ad
.RS 7n
The link was established successfully, but terminated because it was idle.
.RE

.sp
.ne 2
.na
\fB\fB13\fR \fR
.ad
.RS 7n
The link was established successfully, but terminated because the connect time
limit was reached.
.RE

.sp
.ne 2
.na
\fB\fB14\fR \fR
.ad
.RS 7n
Callback was negotiated and an incoming call should arrive shortly.
.RE

.sp
.ne 2
.na
\fB\fB15\fR \fR
.ad
.RS 7n
The link was terminated because the peer is not responding to echo requests.
.RE

.sp
.ne 2
.na
\fB\fB16\fR \fR
.ad
.RS 7n
The link was terminated by the modem hanging up.
.RE

.sp
.ne 2
.na
\fB\fB17\fR \fR
.ad
.RS 7n
The PPP negotiation failed because serial loopback was detected.
.RE

.sp
.ne 2
.na
\fB\fB18\fR \fR
.ad
.RS 7n
The init script failed because a non-zero exit status was returned.
.RE

.sp
.ne 2
.na
\fB\fB19\fR \fR
.ad
.RS 7n
Authentication to the peer failed.
.RE

.SH FILES
.sp
.ne 2
.na
\fB\fB/var/run/sppp\fIn\fR\fR\fB\&.pid\fR \fR
.ad
.RS 29n
Process-ID for \fBpppd\fR process on PPP interface unit \fIn\fR.
.RE

.sp
.ne 2
.na
\fB\fB/var/run/ppp-\fIname\fR\fR\fB\&.pid\fR \fR
.ad
.RS 29n
Process-ID for \fBpppd\fR process for logical link name (see the \fBlinkname\fR
option).
.RE

.sp
.ne 2
.na
\fB\fB/etc/ppp/pap-secrets\fR \fR
.ad
.RS 29n
Usernames, passwords and IP addresses for PAP authentication. This file should
be owned by root and not readable or writable by any other user, otherwise
\fBpppd\fR will log a warning.
.RE

.sp
.ne 2
.na
\fB\fB/etc/ppp/chap-secrets\fR \fR
.ad
.RS 29n
Names, secrets and IP addresses for all forms of CHAP authentication. The
\fB/etc/ppp/pap-secrets\fR file should be owned by \fBroot\fR should not
readable or writable by any other user, otherwise, \fBpppd\fR will log a
warning.
.RE

.sp
.ne 2
.na
\fB\fB/etc/ppp/options\fR \fR
.ad
.RS 29n
System default options for \fBpppd\fR, read before user default options or
command-line options.
.RE

.sp
.ne 2
.na
\fB\fB$HOME/.ppprc\fR \fR
.ad
.RS 29n
User default options, read before \fB/etc/ppp/options.\fIttyname\fR\fR.
.RE

.sp
.ne 2
.na
\fB\fB/etc/ppp/options.\fIttyname\fR\fR \fR
.ad
.RS 29n
System default options for the serial port in use; read after
\fB$HOME/.ppprc\fR. The \fIttyname\fR component of this filename is formed when
the initial \fB/dev/\fR is stripped from the port name (if present), and
slashes (if any) are converted to dots.
.RE

.sp
.ne 2
.na
\fB\fB/etc/ppp/peers\fR \fR
.ad
.RS 29n
Directory with options files that may contain privileged options, even if
\fBpppd\fR was invoked by a user other than \fBroot\fR. The system
administrator can create options files in this directory to permit
non-privileged users to dial out without requiring the peer to authenticate,
but only to certain trusted peers.
.RE

.SH ATTRIBUTES
.sp
.LP
See \fBattributes\fR(5) for descriptions of the following attributes:
.sp

.sp
.TS
box;
c | c
l | l .
ATTRIBUTE TYPE	ATTRIBUTE VALUE
_
Interface Stability	Evolving
.TE

.SH SEE ALSO
.sp
.LP
\fBchat\fR(1M), \fBifconfig\fR(1M), \fBcrypt\fR(3C), \fBpam\fR(3PAM),
\fBattributes\fR(5)
.sp
.LP
Haskin, D., Allen, E. \fIRFC 2472 - IP Version 6 Over PPP\fR. Network Working
Group. December 1998.
.sp
.LP
Jacobson, V. \fIRFC 1144, Compressing TCP/IP Headers for Low-Speed Serial
Links\fR. Network Working Group. February, 1990
.sp
.LP
Lloyd, B., Simpson, W. \fIRFC 1334, PPP Authentication Protocols\fR. Network
Working Group. October 1992.
.sp
.LP
McGregor, G. \fIRFC 1332, The PPP Internet Protocol Control Protocol (IPCP)\fR.
Network Working Group. May 1992.
.sp
.LP
Rivest, R. \fIRFC 1321, The MD5 Message-Digest Algorithm\fR. Network Working
Group. April 1992
.sp
.LP
Simpson, W. \fIRFC 1661, The Point-to-Point Protocol (PPP)\fR. Network Working
Group. July 1994.
.sp
.LP
Simpson, W. \fIRFC 1662, HDLC-like Framing \fR. Network Working Group. July
1994.
.SH NOTES
.sp
.LP
These signals affect \fBpppd\fR behavior:
.sp
.ne 2
.na
\fB\fBSIGINT, SIGTERM\fR \fR
.ad
.RS 20n
Terminate the link, restore the serial device settings and exit.
.RE

.sp
.ne 2
.na
\fB\fBSIGHUP\fR \fR
.ad
.RS 20n
Terminate the link, restore the serial device settings and close the serial
device. If the \fBpersist\fR or \fBdemand\fR option is specified, \fBpppd\fR
attempts to reopen the serial device and start another connection after the
holdoff period. Otherwise \fBpppd\fR exits. If received during the holdoff
period, \fBSIGHUP\fR causes \fBpppd\fR to end the holdoff period immediately.
.RE

.sp
.ne 2
.na
\fB\fBSIGUSR1\fR \fR
.ad
.RS 20n
Toggles the state of the \fBdebug\fR option and prints link status information
to the log.
.RE

.sp
.ne 2
.na
\fB\fBSIGUSR2\fR \fR
.ad
.RS 20n
Causes \fBpppd\fR to renegotiate compression. This is useful to re-enable
compression after it has been disabled as a result of a fatal decompression
error. (Fatal decompression errors generally indicate a bug in an
implementation.)
.RE

.SH DIAGNOSTICS
.sp
.LP
Messages are sent to the syslog daemon using facility \fBLOG_DAEMON\fR. To see
error and debug messages, edit the \fB/etc/syslog.conf\fR file to direct the
messages to the desired output device or file, or use the \fBupdetach\fR or
\fBlogfile\fR options.
.sp
.LP
The \fBdebug\fR option causes the contents of all LCP, PAP, CHAP or IPCP
control packets sent or received to be logged. This is useful if PPP
negotiation does not succeed or if authentication fails.
.sp
.LP
Debugging can also be enabled or disabled by sending a \fBSIGUSR1\fR signal,
which acts as a toggle to the \fBpppd\fR process.