How to troubleshooting PPPoE by Wireshark

[daneth.mean]

Dear All,

We are runing PPPoE at our site and faced some issue with PPPoE always disconnect.

Can any one help me on basic How to troubleshooting PPPoE by wireshark tool?

how we can identify that PPPoE drop at our client site or Our sever site.

Network Diagram:

Client1 DSL modem ---------> DSLAM -----------> Cisco core switch -----------> Ciso Router -----------> Internet

                                                                                         |

                                                                                         |_________________> PPPoE server.

Best Regards,

Danet

[Calin C.]

Hello Danet,

I'm not sure if this is what you expect from us, but on the Cisco core switch you can configure a SPAN session to mirror the traffic from the port connected to DSLAM + the one connected to PPPoE server to an additional port where you connecte a machine with Wireshark (or another analyzer) to check the packets being exchange between the user and server.

Please let us know if this is not what you expect from us or if you need help configuring this.

Cheers,

Calin

[daneth.mean]

Dear Calin,

As i am new in wireshark and seem not understand well on this troubleshooting step.

what should be the filter syntax to capture pppoe on this diagram in wireshark while i have tested it but the result shown more complicated.

Could you please provide a very basic on this issue.

Best Regards,

Danet

[Calin C.]

Hello,

If you understood how to "mirrror" the packets to a wireshark machine, then from here is quite easy:

http://www.firstdigest.com/2009/05/wiresharks-most-useful-display-filters/

- to read something about wireshark and how the filters are used, without having to go through all the documentation

To filter on the PPPoE content in Wireshark you have to do:

pppoes and {filter}

For example:

pppoes and udp  --capture pppoe and udp

pppoes && ip      -- capture pppoe and ip

In wireshark you just have to select the interface on which the packets arrive to your machine and use some filters to select only the relevant information.

Let me know if this helps you!

Cheers,
Calin

[1SABARIVASAN]

https://www.youtube.com/watch?v=6S4jZWp8Nvk

 thios link will help you to find wireshark pppoe analysis'

[1SABARIVASAN]

hi frnd,

i can understand your question. basically pppoe connection can be disconnected from both end. one is customer modem side. another one is ISP server side.

because of modem issue disconnection happens. if you think you dont have modem and medium issue, reach isp for solution.

DSLAM port allocated to that particular customer can be monitored for pppoe packets. PADT is the packet for termination of connection already established. so inspecting the PADT packet from end may give you the understanding. 

THANKS

SABARI VASAN