PPPoE Demystified: How Your Home Broadband Actually "Dials Up"

Open your router's admin page. You'll see something like this:

IP Method: PPPoE. Not DHCP, not a static IP — it says "dial-up."

You might wonder: the fiber is plugged in, the Ethernet cable is connected — why does it still need to "dial"? What does this have to do with the screeching modem sounds of the 90s? And what exactly is the ISP doing during this dial-up process?

This article tears down the complete PPPoE workflow, frame by frame, from the moment you plug in the fiber to the moment your router gets an IP address.

• Why PPPoE exists — why can't we just use DHCP?
• Master the two-phase PPPoE workflow: Discovery + Session
• Understand the three-layer encapsulation: PPP → PPPoE → Ethernet inside a single frame
• Know the difference between PAP and CHAP authentication, and how your broadband password travels over the wire
• Capture real PPPoE frames with tcpdump

• Understand Ethernet frame structure (destination MAC, source MAC, type field)

• Basic understanding of IP address allocation (how DHCP assigns IPs)

• Familiarity with VLAN concepts (helpful but not required)

Imagine you've just moved into a new apartment. The ISP technician plugs the fiber into your ONT (Optical Network Terminal). You power it on. In the router admin page, the WAN port status says "Connecting..."

A few seconds later, "Connecting..." becomes "Connected," and the IP address field shows 10.1.1.143. Your phone connects to Wi-Fi, and you're online.

The question is: in those few seconds, what information did your ONT and the ISP's equipment exchange?

You might think: it's just a DHCP broadcast, the ISP replies with an IP, done. But it's more nuanced than that — the ISP needs to know who you are, whether you've paid your bill, and which IP range to assign you. DHCP alone can't do any of this. That's the problem PPPoE solves.

In a LAN, a device broadcasts a DHCP discover, and the router casually assigns an available IP. This model doesn't cut it for an ISP:

① Authentication is required. The ISP needs to know "which paying customer is this?" DHCP only looks at MAC addresses, and MAC addresses can be spoofed — swap your router and you can impersonate your neighbor.

② Precise accounting is required. Billing by time or by data volume? DHCP only handles the one-time IP assignment and doesn't track subsequent usage.

③ Precise control is required. If your payment is overdue, the ISP needs to kick you off. With DHCP, they'd have to wait for the lease to expire before reclaiming the IP — during which time you'd still have access.

PPPoE, designed in 1999, solves all three. It wraps PPP (Point-to-Point Protocol) inside Ethernet, using PPP for authentication and IP assignment, and Ethernet for the underlying transport.

An analogy:

PPPoE frame structure is like a Russian nesting doll. A normal IP packet destined for the internet goes through this encapsulation:

Compare with a normal LAN frame:

The Ethernet type field changes from 0x0800 (IPv4) to 0x8864 (PPPoE Session) or 0x8863 (PPPoE Discovery). When a router or BRAS sees this value, it knows: "This isn't a normal IP packet. It's a PPPoE packet — I need to strip two headers before I reach the IP layer."

When the ONT first powers on, its WAN port has only a MAC address, no IP. It has no idea which device on the ISP side to talk to. Step one is paging — broadcasting on Ethernet: "Is there a PPPoE server out there?"

This phase uses four packet types, all with Ethernet type 0x8863 (PPPoE Discovery):

Why is PADI a broadcast? Because the ONT has no idea where the BRAS is when it starts. This is the same logic as DHCP discovery — shout first, and the one that answers becomes your target. But unlike DHCP, once the BRAS is found and its MAC is known, all subsequent communication is unicast.

MAC addresses used by each packet:

After the Discovery phase, the ONT and BRAS share a Session ID. From this point forward, all frames use type 0x8864 (PPPoE Session), and the payload is PPP protocol data.

Before any IP packet can be transmitted, the PPP layer must complete three tasks:

4.1 LCP — Link Control Protocol ("Can We Communicate?")

Similar to TCP's three-way handshake, but much simpler. Both sides' PPP modules exchange Configure-Request/Ack messages to negotiate the Maximum Receive Unit (MRU), compression options, and authentication protocol:

4.2 PAP / CHAP — Authentication ("Who Are You?")

Authentication is the core reason PPPoE exists. Two options:

PAP (Password Authentication Protocol) — plaintext:

Simple and straightforward. In theory, an intermediate device could read the password.

CHAP (Challenge Handshake Authentication Protocol) — salted hash:

Most residential broadband in China uses PAP. In practice, this is not a concern — the PPPoE session runs over a dedicated physical fiber between you and the BRAS. There are no intermediate devices eavesdropping, unless someone physically taps into your fiber line (and if they can do that, they have bigger ways to cause trouble than stealing your broadband password).

4.3 IPCP — IP Control Protocol ("Give Me an IP")

After authentication passes, the ONT still has no IP address. This step does not use DHCP broadcasts. Instead, it uses IPCP, a protocol within the PPP stack, negotiated directly inside the PPPoE session:

DHCP vs. IPCP comparison:

From ONT power-on to your phone being able to browse:

Notice the ONT receives 10.1.1.143 — this is an RFC 1918 private address. This means you're behind Carrier-Grade NAT (CG-NAT):

Your data passes through two layers of NAT. The public IP belongs to the ISP, not to your home. This is why:

• curl ifconfig.me shows a different IP than your router's 10.1.1.143
• Port forwarding / DDNS won't work — the public IP isn't yours alone
• Getting a public IP requires contacting your ISP (usually costs extra or requires a business plan)

If your router config shows something like this:

The first connection is the ISP's remote management channel:

• Runs on a separate VLAN 4015, physically isolated from your internet traffic
• PCP priority = 7 (highest), ensuring management commands are never dropped
• Uses DHCP for IP — no dial-up authentication needed, as this is internal ISP communication

1. Check your WAN connection type

   Log into your router admin page (usually 192.168.1.1), find "WAN Settings" or "Network Settings":

   • Does the IP method say PPPoE or DHCP?
   • Is the WAN IP a public address or a private one starting with 10.x or 100.x?
   • If there are multiple connections, is one of them called TR-069?

2. Check PPPoE status on OpenWRT (via SSH)

   bash

   # View PPPoE connection status ifconfig pppoe-wan # View full PPPoE logs logread | grep pppd # You'll see output like: # pppd[1234]: Connect: pppoe-wan <--> vlan2

1. Capture PPPoE discovery/session frames

   If your router runs OpenWRT or your PC is directly connected to the ONT for dial-up, capture PPPoE frames:

   bash

   # Capture all PPPoE traffic (discovery + session) sudo tcpdump -i eth0 'ether proto 0x8863 or ether proto 0x8864' -n -v # Capture discovery phase only sudo tcpdump -i eth0 'ether proto 0x8863' -n -v

   Reboot your ONT and watch the packet capture — you'll see the complete PADI/PADO/PADR/PADS exchange.

2. Confirm whether your WAN IP is private

   bash

   # Check your router's WAN IP # (find it in the admin page, or SSH and run ifconfig) # Compare with your public IP curl ifconfig.me

   If the two IPs differ, you're behind CG-NAT. Check the gateway address your router received — it's usually 10.x.x.1 or 100.x.x.1.

• PPPoE = PPP over Ethernet, running PPP on top of Ethernet for authenticated broadband access.
• PPPoE has two phases: Discovery (PADI→PADO→PADR→PADS, broadcast to find the BRAS) and Session (LCP negotiates the link, PAP/CHAP authenticates, IPCP assigns the IP).
• Frame structure is a three-layer nesting doll: Ethernet → PPPoE → PPP → IP. The Ethernet type field is 0x8863 (Discovery) or 0x8864 (Session).
• The IP assigned via PPPoE is typically a private address (10.x, 100.x), meaning you're behind Carrier-Grade NAT.

PPPoE PPP BRAS LCP IPCP PAP CHAP CG-NAT Session ID PADI PADO PADR PADS

PPPoE solves the problem of "how to connect to the ISP." The 10.1.1.143 you receive may be a private IP, but once you have it, how does your data traverse the ISP's network, pass through multiple routers, and ultimately reach the internet? That's exactly what our network layer section covers.

Continue reading: