authhound-probe vs NTRadPing

NTRadPing is a long-standing free Windows GUI for sending test RADIUS Access-Requests by hand and reading the reply — a tool admins have kept in their kit for around two decades. authhound-probe sits in a different spot: the diagnosis workflow — one signed binary on any OS, real EAP logins, plain-English verdicts with next steps, and machine-readable output for scripts. This page is a factual comparison so you can pick the right tool for the job at hand — including when that tool isn't ours.

What each tool is

NTRadPing is a small, free Windows application: you point it at a RADIUS server, type in the shared secret and the RADIUS attributes you want to send, fire an Access-Request, and read the raw reply. It's oriented around PAP/CHAP-style requests you assemble manually, which makes it a quick way to confirm a server answers and a secret is right — from a Windows box with a GUI in front of you.

authhound-probe is built for answering "why is 802.1X broken and which hop do I fix": real PEAP-MSCHAPv2 / EAP-TLS / EAP-TTLS / PAP logins with a verdict per layer (reachability → secret → auth → certificate → MTU), plus checks the classics don't attempt — server certificate analysis, path-MTU probing, RadSec, BlastRADIUS posture. It's a single signed binary for Linux, macOS and Windows.

On a box that already runs FreeRADIUS, radtest is the other quick option — a CLI that sends PAP/CHAP Access-Requests with no download needed. It's the closest Linux equivalent to what NTRadPing does on Windows. For the fuller three-way comparison of the CLI test tools, see authhound-probe vs eapol_test vs radtest.

The gap that matters most: EAP

The single most important difference for an 802.1X problem: NTRadPing sends RADIUS Access-Requests where you assemble the attributes — it does not perform the EAP handshakes (PEAP-MSCHAPv2, EAP-TLS, EAP-TTLS) that real 802.1X clients use. So it can verify that the RADIUS server is reachable and answers, but not the way your Wi-Fi and wired clients actually authenticate. When the failure is in the EAP exchange — a certificate the client rejects, an inner-method mismatch, a handshake that stalls — a PAP/CHAP Access-Request simply won't exercise the code path that's breaking. That's the core reason to reach for a tool that speaks EAP.

Other concrete differences

• Platform: NTRadPing is Windows-only; the probe is one signed binary for Linux, macOS and Windows (also a Docker image and go install).
• Workflow: NTRadPing is a GUI where you enter attributes by hand; the probe is one command with flags.
• Deeper checks: NTRadPing doesn't analyse the server certificate, probe path-MTU / EAP fragmentation, test RadSec, or report BlastRADIUS (CVE-2024-3596) posture; the probe returns PASS/WARN/FAIL verdicts on each of those.
• Scripting: NTRadPing is a GUI, so it isn't scriptable; the probe emits --json with a versioned schema and stable exit codes, which is what you hand to an RMM or a monitoring check.

The same test, as one command

Here's the "send a test authentication to this RADIUS server" task — the thing you'd open NTRadPing for — as an authhound-probe command. Same PAP request, but the secret goes in an environment variable rather than a field, so it never lands in shell history or ps:

# Send a test authentication to a RADIUS server with authhound-probe —
# the direct NTRadPing equivalent (a PAP request). Secret via env var so it
# never lands in argv/shell history; the account password is prompted, no echo.
export AUTHHOUND_RADIUS_SECRET='shared-secret'
authhound-probe radius test --server 10.20.0.10 --pap alice

And the part NTRadPing can't do — an actual EAP login, the way a real 802.1X client authenticates — is the same command with a different flag:

# Swap --pap for --peap to run the EAP login NTRadPing can't do —
# the way a real Wi-Fi / wired 802.1X client authenticates:
authhound-probe radius test --server 10.20.0.10 --peap alice \
  --server-name radius.corp.com

At a glance

When NTRadPing is still fine

Honestly: for a quick manual PAP/CHAP sanity check on a Windows admin box — "does this server answer, is the secret right, what attributes come back" — with a GUI already in front of you, NTRadPing does the job it always has. If that's the question and you're on Windows, there's nothing wrong with reaching for it. It earned its place in a lot of toolkits for a reason.

When the probe is the better fit

Reach for authhound-probe when the question goes past "does the server answer": a Wi-Fi or wired 802.1X / EAP problem (PEAP-MSCHAPv2, EAP-TLS, EAP-TTLS), a question about the server certificate, MTU/fragmentation, RadSec, or BlastRADIUS posture, a Linux, macOS or headless box where there's no NTRadPing to run, or anything you want to script or hand to a colleague — --json with a versioned schema and stable exit codes drops straight into an RMM. It gives a verdict per layer with guidance on what to check next, rather than a raw reply you interpret yourself.

FAQ

Does NTRadPing work on modern Windows / is it still maintained?

NTRadPing is a long-standing free Windows tool that many admins have relied on for years; it runs as a standard Windows GUI. We can’t verify its current maintenance status or a specific list of supported Windows versions, so we won’t claim one — but if it launches and can reach your server, it does what it has always done: send RADIUS Access-Requests and show you the reply.

Can NTRadPing test PEAP or EAP-TLS?

No. NTRadPing sends RADIUS Access-Requests with the attributes you set by hand (PAP/CHAP-style); it does not perform the EAP handshakes that PEAP-MSCHAPv2 or EAP-TLS require. To test the way real 802.1X clients authenticate, use a tool that speaks EAP — authhound-probe or eapol_test.

Is there a Linux or macOS version of NTRadPing?

There is no native NTRadPing for Linux or macOS. On those platforms, authhound-probe (one cross-platform binary) or radtest (where the FreeRADIUS utilities are installed) fills the same "send a test request and read the reply" role.

What’s a free NTRadPing alternative?

authhound-probe is a free, open-source single binary for Linux, macOS and Windows. It covers the PAP/CHAP sanity check NTRadPing does, and adds real EAP logins (PEAP-MSCHAPv2, EAP-TLS, EAP-TTLS), certificate / MTU / RadSec / BlastRADIUS checks, and --json output you can script.

See also

• Probe quickstart

  Install, register the probe on FreeRADIUS or NPS, run your first test in about a minute.

• Flag reference

  Every flag for radius test and radsec test, generated from the shipped binary.

• authhound-probe vs eapol_test vs radtest

  The fuller comparison of the CLI EAP test tools, if you're weighing those against the probe too.

• KB: RADIUS server not responding

  When your test request times out instead of answering — the silent-drop causes, in likelihood order.

• KB: FreeRADIUS "unknown client"

  The most common reason a test from a new IP gets no reply at all — the server is ignoring you on purpose.

Something in this comparison outdated or unfair — including anything about NTRadPing? The maintained source of truth is COMPARISON.md in the probe repo — open an issue there; factual corrections are very welcome.