18. Type(类型) :代表请求或响应的类型，每个封包只有一种类型。响应的Type字段总是和请求的一致。Type取1－3，含义分别为
1: Identity(身份) 认证者通常以Identity作为初始请求，写做Request/Identity，表示认证者请求某种用户名称，以便进行身份验证，此时Type－Data字段包含了用户名称。
2 : Notifacation (通知) 认证者可以通过Notification类型传送消息给用户。
3 : NAK (否定确认) 用来建议使用新的验证方式，认证者会在type-Data中指定建议使用的认证类型。
大于等于4的Type值代表身份验证方式，具体含义如下Type codeAuthentication protocolDescription4MD5 ChallengeCHAP-like authentication in EAP6GTCOriginally intended for use with token cards such as RSA SecurID13EAP-TLSMutual authentication with digital certificates21TTLSTunneled TLS; protects weaker authentication methods with TLS encryption25PEAPProtected EAP; protects weaker EAP methods with TLS encryption18EAP-SIMAuthentication by mobile phone Subscriber Identity Module (SIM)29MS-CHAP-V2Microsoft encrypted password authentication; compatible with Windows domains
21. The authenticator issues a Request/Identity packet to identify the user. Request/Identity packets serve two purposes. In addition to starting the exchange, they also serve notice to the client that the network is likely to drop any data traffic before authentication completes.
The end user system prompts for input, collects the user identifier, and sends the user identifier in a Response/Identity message.
With the user identified, the authenticator can issue authentication challenges. In step 3 in the figure, the authenticator issues an MD-5 Challenge to the user with a Request/MD-5 Challenge packet.
The user system is configured to use a token card for authentication, so it replies with a Response/NAK, suggesting the use of Generic Token Card authentication.
The authenticator issues a Request/Generic Token Card challenge, prompting for the numerical sequence on the card.
22.
The user types a response, which is passed along in a Response/Generic Token Card.
If the user response is not correct, authentication is not possible. However, the authenticator EAP implementation allows for multiple authentication Requests, so a second Request/Generic Token Card is issued.
Once again, the user types a response, which is passed along in a Response/Generic Token Card.
9. On the second try, the response is correct, so the authenticator issues a Success message.
23. 三、802.1x：网络连接端口认证
1、背景知识
802.1X首先是一个认证协议，为任何局域网，包括无线局域网，提供了用户认证的框架。它是基于端口的，这里的端口可以是一个实实在在的物理端口也可以是一个就像VLAN一样的逻辑端口，对于无线局域网来说个“端口”就是一条信道。它的最终目的就是确定一个端口是否可用。对于一个端口，如果认证成功那么就“打开”这个端口，允许所有的报文通过，如果认证不成功就使这个端口保持“关闭”，此时只允许802.1X的认证报文EAPOL（Extensible Authentication Protocol over LAN）通过。
24. 802.1x的交互过程定义了三个组件，如上图所示。申请者是寻求访问网络资源的用户机器，访问过程由认证者控制，二者统称为端口认证实体(PAE)。任何用户信息都被送至认证服务器(例如RADIUS)进行实际的处理。整个过程逻辑上是通过认证者和认证服务器来完成的，认证者扮演中介的角色。申请者和认证者之间使用802.1x定义的EAP over LAN协议，后端采用RADIUS封包来传递EAP封包。
2、EAPOL的封包格式
下图是Ethernet以及802.11的封包格式，两者的标头不一致，但有效载荷相同，我们只讨论它的有效载荷。
Ethernet Type:(以太网类型) 表示以太网的类型，EAPOL的类型代码是88-8e。
Packet Type: EAPOL是EAP的扩展，除了以前所描述的信息外，EAPOL还加入了一些额外的信息，让EAP能够适应基于连接端口的LAN环境。
Packet Body (封包主体): 此字段的长度不定，除EAPOL-Start和EAPOL-Logoff消息外，此字段会出现在所有的EAPOL帧中。EAP-Packet是EAP封包，EAP-Key帧封装了密钥。
