Flag reference
Every flag the probe accepts, for each subcommand. This page is generated
from the binary's own --help — so what you read here is
exactly what the shipped tool does.
authhound-probe radius test
Runs local, read-only RADIUS/802.1X checks. Nothing leaves this host.
authhound-probe radius test --server HOST --secret SECRET [--pap user:pass]| Flag | Description |
|---|---|
--bind STRING | source IP[:port] to send from, for pinning the outgoing interface on a multi-homed host |
--client-cert STRING | client certificate (PEM) for an EAP-TLS auth test |
--client-key STRING | client private key (PEM) for the EAP-TLS test |
--count INT | run the checks N times (2..50) and report aggregate statistics — for chasing intermittent failures (default 1) |
--expect-attr VALUE | assert a returned authorization attribute as 'Name=Value' (repeatable); a mismatch is a FAIL |
--expect-vlan STRING | assert the Access-Accept assigns this VLAN (Tunnel-Private-Group-ID); a mismatch is a FAIL |
--interval DURATION | pause between --count iterations (a hard-coded safety floor applies) (default 2s) |
--json | emit results as JSON instead of text |
--mtu | run the path-MTU / fragmentation probe (sends a few padded packets) |
--nas-id STRING | NAS-Identifier to send (default authhound-probe) |
--nas-port-type STRING | NAS-Port-Type: wireless, ethernet, or virtual (default wireless) |
--no-color | disable ANSI colour |
--pap STRING | run a PAP auth test as 'user:password', or just 'user' to be prompted for the password |
--password-file STRING | read the auth password from this file, for any --pap/--peap/--ttls given as just 'user' |
--peap STRING | run a PEAP-MSCHAPv2 auth test as 'user:password', or just 'user' to be prompted |
--secret STRING | shared secret (leaks into shell history/ps — prefer AUTHHOUND_RADIUS_SECRET, --secret-file, or the prompt) |
--secret-file STRING | read the shared secret from this file (must not be world-readable on unix) |
--secret-stdin | read the shared secret from standard input (one line) |
--server STRING | RADIUS server host or host:port (default port 1812); comma-separate several to compare them (e.g. primary,secondary) |
--server-name STRING | name the server certificate must be valid for (also sent as TLS SNI); omitted = name validation skipped and reported as a warning |
--strict | exit non-zero on warnings too (for scheduled monitoring) |
--timeout DURATION | per-request timeout (default 5s) |
--ttls STRING | run an EAP-TTLS (inner PAP) auth test as 'user:password', or just 'user' to be prompted |
authhound-probe radsec test
Checks a RadSec (RADIUS/TLS, TCP/2083) endpoint. Nothing leaves this host.
authhound-probe radsec test --server HOST [--client-cert cert.pem --client-key key.pem]| Flag | Description |
|---|---|
--client-cert STRING | client certificate (PEM) for mutual TLS; optional |
--client-key STRING | client private key (PEM); required with --client-cert |
--json | emit results as JSON instead of text |
--no-color | disable ANSI colour |
--server STRING | RadSec server host or host:port (default port 2083) |
--server-name STRING | name the server certificate must be valid for (also sent as TLS SNI); omitted = name validation skipped and reported as a warning |
--strict | exit non-zero on warnings too (for scheduled monitoring) |
--timeout DURATION | connection/handshake timeout (default 5s) |
Exit codes
The same contract for both subcommands — stable, so scripts and schedulers can depend on it:
| Code | Meaning |
|---|---|
0 | all checks passed (warnings allowed unless --strict) |
1 | a check FAILED — or, under --strict, a WARN (e.g. a cert expiring soon) |
2 | usage error (bad flags or missing --server) |
With --json, the result is machine-readable instead —
.summary.fail/.summary.warn and per-check
.results[].status. Versioned schema in the
repo.
Related
- Quickstart
Install, register the probe, and run your first test with these flags.
- Troubleshooting
When a flag isn't behaving —
--bind,--server-name, cert paths. - RADIUS attribute & VSA reference
The attributes
--expect-attrand--expect-vlanassert on, explained.
No spam, no sharing — one email when it's ready, and you can reply to be removed anytime.