pppoe

Overview ¶

Package pppoe decodes Point-to-Point Protocol over Ethernet packets per RFC 2516 — both the Discovery phase (PADI / PADO / PADR / PADS / PADT) and the Session phase (PPP-in- PPPoE payload).

Wrap-vs-native judgement

Native. RFC 2516 is fully public; PPPoE is a tight
6-byte header (Version+Type byte + Code + Session ID +
Length) followed by either a TLV stream (Discovery
stage) or a PPP frame (Session stage). No crypto, no
compression, no varints. Operators paste post-Ethernet
bytes (EtherType 0x8863 for Discovery or 0x8864 for
Session) from a `tcpdump -X ether proto 0x8863` line, a
Wireshark Follow-Frame view, or any PPPoE-emitting tool
and get the documented header + per-phase body.

What this package covers

• **6-byte header**:

• byte 0: Version (4 bits) + Type (4 bits). Both MUST be 1 per RFC 2516 (so byte 0 must be 0x11). Other values surface a conformance Note.

• byte 1: **Code** with **6-entry name table**:

• 0x00 Session (PPPoE Session; carries a PPP frame)

• 0x09 PADI (PPPoE Active Discovery Initiation — client broadcasts to find an Access Concentrator)

• 0x07 PADO (PPPoE Active Discovery Offer — AC responds with its services)

• 0x19 PADR (PPPoE Active Discovery Request — client picks an AC)

• 0x65 PADS (PPPoE Active Discovery Session- confirmation — AC assigns a Session ID)

• 0xA7 PADT (PPPoE Active Discovery Terminate — either side tearing down the session)

• bytes 2-3: Session ID (uint16 BE; 0x0000 during Discovery, then assigned by the AC in PADS).

• bytes 4-5: Length (uint16 BE; length of the payload after the 6-byte header).

• **Discovery TLV walker** (Codes 0x09 / 0x07 / 0x19 / 0x65 / 0xA7): each TLV is Tag Type (2 bytes BE) + Tag Length (2 bytes BE) + Tag Value (Length bytes). The walker iterates until end-of-list (Tag Type 0x0000) or buffer exhaustion. **9-entry Tag Type name table** (RFC 2516 §4):

• 0x0000 End-Of-List

• 0x0101 Service-Name (UTF-8)

• 0x0102 AC-Name (Access Concentrator Name, UTF-8)

• 0x0103 Host-Uniq (opaque cookie chosen by client to match PADO replies to its PADI)

• 0x0104 AC-Cookie (opaque cookie chosen by AC; client echoes back in PADR for DoS mitigation)

• 0x0105 Vendor-Specific (4-byte vendor ID + opaque body)

• 0x0110 Relay-Session-ID (binary; used by intermediate relays)

• 0x0201 Service-Name-Error (UTF-8 error message when Service-Name can't be honoured)

• 0x0202 AC-System-Error (UTF-8 error)

• 0x0203 Generic-Error (UTF-8 error)

• **Session-stage payload** (Code 0x00): the first 2 bytes of the PPPoE payload are the PPP Protocol Identifier (uint16 BE per RFC 1661). **9-entry PPP Protocol name table**:

• 0x0021 IPv4

• 0x0057 IPv6

• 0x8021 IPCP (IP Control Protocol)

• 0x8057 IPv6CP

• 0xC021 LCP (Link Control Protocol)

• 0xC023 PAP (Password Authentication Protocol)

• 0xC223 CHAP (Challenge Handshake Authentication Protocol)

• 0xC227 EAP-over-PPP (deprecated value)

• 0xC229 EAP (Extensible Authentication Protocol)

• **Conformance checks**:

• Version != 1 or Type != 1 surfaces a Note.

• PADx codes with non-zero Session ID surface a Note (only PADS and Session can have a non-zero ID).

• Length field mismatch (declared vs buffer remaining) surfaces a Note.

What this package does NOT cover (deliberately out of scope)

• Ethernet framing — feed the PPPoE bytes after the EtherType 0x8863 (Discovery) / 0x8864 (Session) strip.

• PPP frame deep dissection (LCP CONFIG-REQ option TLVs, PAP / CHAP / EAP protocol exchanges, IPCP option TLVs) — the Session payload's Protocol ID is recognised but the body is surfaced as raw hex. Inner IPv4 / IPv6 payloads can be piped to `ip_packet_decode`.

• PPPoE Tag Value deep dissection beyond UTF-8 / hex surface — Vendor-Specific body, Service-Name semantics, etc., belong in operator analysis or a sibling helper.