authhound-probe vs eapol_test vs radtest

eapol_test and radtest are the two tools RADIUS admins have reached for over two decades, and both are excellent at what they were built for. authhound-probe sits in a different spot: the diagnosis workflow — one binary, no config file, plain-English verdicts with next steps, machine-readable output for RMM scripts. This page is a factual comparison so you can pick the right tool for the job at hand — including when that tool isn't ours.

What each tool is

eapol_test (part of Jouni Malinen's wpa_supplicant/hostap project) is the reference EAP test client. It plays both the EAP peer and the RADIUS client in one process, so it runs a complete EAP authentication against your server without needing a switch or AP in the middle. Nothing else covers as many EAP methods, and its full protocol trace is the ground truth when you're debugging genuinely weird interop problems.

radtest (from the FreeRADIUS utilities, a wrapper around radclient) is the fastest possible "does an Access-Request come back" sanity check. PAP by default — also CHAP and MSCHAP via radclient — but no EAP, so it can't authenticate the way real 802.1X clients do. Its virtue is ubiquity: it's already installed anywhere FreeRADIUS is.

authhound-probe is built for answering "why is 802.1X broken and which hop do I fix": real PEAP-MSCHAPv2 / EAP-TLS / EAP-TTLS / PAP logins with a verdict per layer (reachability → secret → auth → certificate → MTU), plus checks the classics don't attempt — path-MTU probing, BlastRADIUS posture, VLAN assertions, RadSec. Single signed binary for Linux, macOS and Windows.

Getting each one running

The install burden differs more than the feature lists do, so it's worth being concrete. radtest is one package (freeradius-utils) where it isn't already present. eapol_test is usually a source build — it's a test program the wpa_supplicant project doesn't ship by default, so you compile it with a build flag (Debian/Ubuntu package it as eapoltest, FreeBSD has a security/eapol_test port; on most other platforms, including every Windows box, you're building or out of luck):

# eapol_test is built from wpa_supplicant source with one extra config flag.
# Prereqs: a C toolchain and OpenSSL headers (build-essential + libssl-dev on
# Debian/Ubuntu; some defconfigs also want libnl/dbus headers).
git clone https://w1.fi/hostap.git
cd hostap/wpa_supplicant
cp defconfig .config
echo CONFIG_EAPOL_TEST=y >> .config
make eapol_test

The probe is a single static binary download — signed releases for Linux/macOS/Windows, a Docker image, or go install.

A working eapol_test PEAP config

If you go the eapol_test route, here's the common case done properly — a PEAP-MSCHAPv2 test that validates the server certificate the way your real clients would. One config file per scenario:

# peap.conf — one eapol_test scenario: PEAP-MSCHAPv2 as a corporate laptop would do it
network={
    key_mgmt=WPA-EAP
    eap=PEAP
    identity="alice"
    password="the-test-account-password"
    phase2="auth=MSCHAPV2"
    ca_cert="/etc/ssl/certs/corp-radius-ca.pem"
    # validate the server cert's name the way real clients do:
    domain_suffix_match="radius.corp.com"
}

chmod 600 peap.conf   # the account password lives in this file
eapol_test -c peap.conf -a 10.20.0.10 -s 'shared-secret'

You'll get a few hundred lines of protocol trace; the verdict is the last line — SUCCESS or FAILURE — and the exit code is 0 on success, which is what to script against.

The equivalent probe run, for comparison:

# the same test with authhound-probe — no config file, secret via env,
# password prompted with no echo
export AUTHHOUND_RADIUS_SECRET='shared-secret'
authhound-probe radius test --server 10.20.0.10 --peap alice \
  --server-name radius.corp.com

At a glance

When eapol_test is still the right tool

Honestly: often. Reach for eapol_test when you need an EAP method the probe doesn't speak — EAP-FAST, EAP-PWD, EAP-SIM/AKA, or an exotic inner method — or when you want the full protocol trace to debug a genuinely weird interop problem. It is the reference implementation; its debug output is the ground truth, and no other tool comes close on method coverage. The cost is getting a build of it, writing a config file per scenario, and reading raw protocol output.

radtest keeps its place too: on a box that already has FreeRADIUS installed, it's a two-second answer to "does the server accept this PAP login / is the secret right" — no download needed.

When the probe is the better fit

Use authhound-probe when the question is "why is 802.1X broken and which hop do I fix" or "script this check into my RMM": one command with flags, a verdict per layer with guidance on what to check next, --json with a versioned schema and stable exit codes, and the same binary on the Windows box next to your NPS server. It covers the methods that dominate real networks (PAP, PEAP-MSCHAPv2, EAP-TTLS/PAP, EAP-TLS) plus the checks the classics don't attempt: certificate expiry/name verdicts, path-MTU probing, RadSec, BlastRADIUS posture, and multi-server drift comparison.

They compose, too: plenty of workflows start with the probe to localise the failure in seconds, then drop into eapol_test for a protocol-level trace of the one broken method.

FAQ

What is eapol_test?

eapol_test is a test utility from Jouni Malinen’s wpa_supplicant/hostap project. It acts as both the EAP peer and the RADIUS client in one process, so it can run a complete EAP authentication (PEAP, EAP-TLS, EAP-TTLS, EAP-FAST, and many more) against a RADIUS server directly — no switch or access point needed. It is the reference EAP test client, with the widest method coverage of any tool.

How do I install eapol_test?

eapol_test is usually compiled from wpa_supplicant source: clone the hostap repository, copy defconfig to .config in the wpa_supplicant directory, add CONFIG_EAPOL_TEST=y, and run make eapol_test. You need a C toolchain and OpenSSL development headers. Some systems package it — Debian/Ubuntu ship an eapoltest package and FreeBSD has a security/eapol_test port — but on most platforms you build it yourself.

Does eapol_test run on Windows?

Not practically. There are no maintained Windows binaries, so testing from a Windows box means WSL or a different tool. authhound-probe ships a signed Windows .exe and radtest can run under WSL where FreeRADIUS utilities are installed.

What is the difference between eapol_test and radtest?

radtest (a wrapper around radclient from the FreeRADIUS utilities) sends plain Access-Request packets — PAP by default, also CHAP and MSCHAP — but speaks no EAP at all, so it cannot test PEAP or EAP-TLS the way real 802.1X clients authenticate. eapol_test is the opposite: full EAP with the widest method coverage, but no plain PAP. They answer different questions.

See also

• Probe quickstart

  Install, register the probe on FreeRADIUS or NPS, run your first test in about a minute.

• Flag reference

  Every flag for radius test and radsec test, generated from the shipped binary.

• KB: EAP stalls mid-handshake

  The failure mode where a protocol-level view matters — and the fragment_size fix.

• KB: TLS alert "unknown CA"

  The cert-trust reject both eapol_test and the probe will surface — and how to fix it server-side.

Something in this comparison outdated or unfair? The maintained source of truth is COMPARISON.md in the probe repo — open an issue there; factual corrections are very welcome.