if_pppoe ping works but dns doesn't?
-
Since the release of if_pppoe I'm always getting the same issue, no dns resolving but ping works.
Sep 5 09:17:58 ppp 48942 process 48942 terminated Sep 5 09:17:58 ppp 48942 [wan_link0] Link: Shutdown Sep 5 09:17:58 ppp 48942 [wan] Bundle: Shutdown Sep 5 09:17:56 ppp 48942 [wan_link0] LCP: Close event Sep 5 09:17:56 ppp 48942 [wan_link0] Link: CLOSE event Sep 5 09:17:56 ppp 48942 [wan_link0] LCP: state change Closing --> Initial Sep 5 09:17:56 ppp 48942 [wan_link0] LCP: LayerFinish Sep 5 09:17:56 ppp 48942 [wan_link0] LCP: Down event Sep 5 09:17:56 ppp 48942 [wan_link0] LCP: state change Stopping --> Closing Sep 5 09:17:56 ppp 48942 [wan_link0] LCP: Close event Sep 5 09:17:56 ppp 48942 [wan_link0] Link: giving up after 0 reconnection attempts Sep 5 09:17:56 ppp 48942 [wan_link0] Link: DOWN event Sep 5 09:17:56 ppp 48942 [wan_link0] PPPoE: connection closed Sep 5 09:17:56 ppp 48942 [wan_link0] LCP: LayerDown Sep 5 09:17:56 ppp 48942 [wan_link0] LCP: SendTerminateAck #4 Sep 5 09:17:56 ppp 48942 [wan] IPV6CP: state change Closed --> Initial Sep 5 09:17:56 ppp 48942 [wan] IPV6CP: Down event Sep 5 09:17:56 ppp 48942 [wan] IPCP: state change Closed --> Initial Sep 5 09:17:56 ppp 48942 [wan] IPCP: Down event Sep 5 09:17:56 ppp 48942 [wan] IPV6CP: Close event Sep 5 09:17:56 ppp 48942 [wan] IPCP: Close event Sep 5 09:17:56 ppp 48942 [wan] Bundle: Status update: up 0 links, total bandwidth 9600 bps Sep 5 09:17:56 ppp 48942 [wan_link0] Link: Leave bundle "wan" Sep 5 09:17:56 ppp 48942 [wan_link0] LCP: state change Opened --> Stopping Sep 5 09:17:56 ppp 48942 [wan_link0] LCP: rec'd Terminate Request #70 (Opened) Sep 5 09:17:56 ppp 48942 [wan] Bundle: closing link "wan_link0"... Sep 5 09:17:56 ppp 48942 [wan] Bundle: No NCPs left. Closing links... Sep 5 09:17:56 ppp 48942 [wan] IPV6CP: LayerFinish Sep 5 09:17:56 ppp 48942 [wan] IPV6CP: state change Closing --> Closed Sep 5 09:17:56 ppp 48942 [wan] IPV6CP: rec'd Terminate Ack #2 (Closing) Sep 5 09:17:56 ppp 48942 [wan] IPCP: LayerFinish Sep 5 09:17:56 ppp 48942 [wan] IPCP: state change Closing --> Closed Sep 5 09:17:56 ppp 48942 [wan] IPCP: rec'd Terminate Ack #4 (Closing) Sep 5 09:17:56 ppp 48942 [wan] IPCP: SendTerminateReq #5 Sep 5 09:17:56 ppp 48942 [wan] IFACE: Set description "WAN" Sep 5 09:17:56 ppp 48942 [wan] IFACE: Rename interface pppoe0 to pppoe0 Sep 5 09:17:56 ppp 48942 [wan] IFACE: Down event Sep 5 09:17:55 ppp 48942 [wan] IPV6CP: LayerDown Sep 5 09:17:55 ppp 48942 [wan] IPV6CP: SendTerminateReq #2 Sep 5 09:17:55 ppp 48942 [wan] IPV6CP: state change Opened --> Closing Sep 5 09:17:55 ppp 48942 [wan] IPV6CP: Close event Sep 5 09:17:55 ppp 48942 [wan] IFACE: Removing IPv4 address from pppoe0 failed(IGNORING for now. This should be only for PPPoE friendly!): Can't assign requested address Sep 5 09:17:54 ppp 48942 [wan] IPCP: LayerDown Sep 5 09:17:54 ppp 48942 [wan] IPCP: SendTerminateReq #4 Sep 5 09:17:54 ppp 48942 [wan] IPCP: state change Opened --> Closing Sep 5 09:17:54 ppp 48942 [wan] IPCP: Close event Sep 5 09:17:54 ppp 48942 [wan] IFACE: Close event Sep 5 09:17:54 ppp 48942 caught fatal signal TERM Sep 4 18:00:34 ppp 48942 [wan] 020a:f7ff:fe49:8660 -> 0200:00ff:fe00:0000 Sep 4 18:00:34 ppp 48942 [wan] IPV6CP: LayerUp Sep 4 18:00:34 ppp 48942 [wan] IPV6CP: state change Ack-Sent --> Opened Sep 4 18:00:34 ppp 48942 [wan] IPV6CP: rec'd Configure Ack #1 (Ack-Sent) Sep 4 18:00:34 ppp 48942 [wan] IFACE: Add description "WAN" Sep 4 18:00:34 ppp 48942 [wan] IFACE: Rename interface ng0 to pppoe0 Sep 4 18:00:34 ppp 48942 [wan] IFACE: Up event Sep 4 18:00:34 ppp 48942 [wan] 107.xxx.xxx.38 -> 198.xxx.xxx.33 Sep 4 18:00:34 ppp 48942 [wan] IPCP: LayerUp Sep 4 18:00:34 ppp 48942 [wan] IPCP: state change Ack-Sent --> Opened Sep 4 18:00:34 ppp 48942 [wan] IPADDR 107.xxx.xxx.38 Sep 4 18:00:34 ppp 48942 [wan] IPCP: rec'd Configure Ack #3 (Ack-Sent) Sep 4 18:00:34 ppp 48942 [wan] IPV6CP: state change Req-Sent --> Ack-Sent Sep 4 18:00:34 ppp 48942 [wan] IPV6CP: SendConfigAck #202 Sep 4 18:00:34 ppp 48942 [wan] IPV6CP: rec'd Configure Request #202 (Req-Sent) Sep 4 18:00:34 ppp 48942 [wan] IPADDR 107.xxx.xxx.38 Sep 4 18:00:34 ppp 48942 [wan] IPCP: SendConfigReq #3 Sep 4 18:00:34 ppp 48942 [wan] 107.xxx.xxx.38 is OK Sep 4 18:00:34 ppp 48942 [wan] IPADDR 107.xxx.xxx.38 Sep 4 18:00:34 ppp 48942 [wan] IPCP: rec'd Configure Nak #2 (Ack-Sent) Sep 4 18:00:34 ppp 48942 [wan] IPADDR 0.0.0.0 Sep 4 18:00:34 ppp 48942 [wan] IPCP: SendConfigReq #2 Sep 4 18:00:34 ppp 48942 [wan] COMPPROTO VJCOMP, 16 comp. channels, no comp-cid Sep 4 18:00:34 ppp 48942 [wan] IPCP: rec'd Configure Reject #1 (Ack-Sent) Sep 4 18:00:34 ppp 48942 [wan] IPCP: state change Req-Sent --> Ack-Sent Sep 4 18:00:34 ppp 48942 [wan] IPADDR 198.xxx.xxx.33 Sep 4 18:00:34 ppp 48942 [wan] IPCP: SendConfigAck #167 Sep 4 18:00:34 ppp 48942 [wan] 198.xxx.xxx.33 is OK Sep 4 18:00:34 ppp 48942 [wan] IPADDR 198.xxx.xxx.33 Sep 4 18:00:34 ppp 48942 [wan] IPCP: rec'd Configure Request #167 (Req-Sent) Sep 4 18:00:34 ppp 48942 [wan] IPV6CP: SendConfigReq #1 Sep 4 18:00:34 ppp 48942 [wan] IPV6CP: state change Starting --> Req-Sent Sep 4 18:00:34 ppp 48942 [wan] IPV6CP: Up event Sep 4 18:00:34 ppp 48942 [wan] COMPPROTO VJCOMP, 16 comp. channels, no comp-cid Sep 4 18:00:34 ppp 48942 [wan] IPADDR 0.0.0.0 Sep 4 18:00:34 ppp 48942 [wan] IPCP: SendConfigReq #1 Sep 4 18:00:34 ppp 48942 [wan] IPCP: state change Starting --> Req-Sent Sep 4 18:00:34 ppp 48942 [wan] IPCP: Up event Sep 4 18:00:34 ppp 48942 [wan] IPV6CP: LayerStart Sep 4 18:00:34 ppp 48942 [wan] IPV6CP: state change Initial --> Starting Sep 4 18:00:34 ppp 48942 [wan] IPV6CP: Open event Sep 4 18:00:34 ppp 48942 [wan] IPCP: LayerStart Sep 4 18:00:34 ppp 48942 [wan] IPCP: state change Initial --> Starting Sep 4 18:00:34 ppp 48942 [wan] IPCP: Open event Sep 4 18:00:34 ppp 48942 [wan] Bundle: Status update: up 1 link, total bandwidth 64000 bps Sep 4 18:00:34 ppp 48942 [wan_link0] Link: Join bundle "wan" Sep 4 18:00:34 ppp 48942 [wan_link0] Link: Matched action 'bundle "wan" ""' Sep 4 18:00:34 ppp 48942 [wan_link0] LCP: authorization successful Sep 4 18:00:34 ppp 48942 [wan_link0] CHAP: rec'd SUCCESS #51 len: 4 Sep 4 18:00:34 ppp 48942 [wan_link0] CHAP: sending RESPONSE #51 len: 40 Sep 4 18:00:34 ppp 48942 [wan_link0] CHAP: Using authname "xxx@pppoe.ebox.net" Sep 4 18:00:34 ppp 48942 [wan_link0] Name: "JUNOS"
Sep 5 09:29:45 nginx 2025/09/05 09:29:45 [error] 81461#100290: send() failed (54: Connection reset by peer) while logging to syslog, server: unix:/var/run/log Sep 5 09:29:45 php-fpm 79579 /index.php: Successful login for user 'admin' from: 10.10.0.11 (Local Database) Sep 5 09:20:26 login 64826 login on ttyv0 as root Sep 5 09:20:25 vnstatd 46318 Interface "bce1.40" disabled. Sep 5 09:20:25 vnstatd 46318 Interface "bxe0.30" disabled. Sep 5 09:20:25 vnstatd 46318 Monitoring (17): pppoe0 (1000 Mbit) pfsync0 (1000 Mbit) pflog0 (1000 Mbit) ovpns3 (1000 Mbit) ovpns2 (1000 Mbit) ovpns1 (1000 Mbit) enc0 (1000 Mbit) bxe1 (10000 Mbit) bxe0.69 (10000 Mbit) bxe0.6 (10000 Mbit) bxe0.5 (10000 Mbit) bxe0.4 (10000 Mbit) bxe0.30 (1000 Mbit) bxe0 (10000 Mbit) bce1.40 (1000 Mbit) bce1 (1000 Mbit) bce0 (1000 Mbit) Sep 5 09:20:25 vnstatd 46318 Data retention: 48 5MinuteHours, 4 HourlyDays, 62 DailyDays, 25 MonthlyMonths, -1 YearlyYears, 20 TopDayEntries Sep 5 09:20:25 vnstatd 46318 vnStat daemon 2.12 (pid:46318 uid:0 gid:0, SQLite 3.46.1) Sep 5 09:20:25 vnstatd 48885 Error: pidfile "/var/run/vnstat/vnstat.pid" lock failed (Resource temporarily unavailable), exiting. Sep 5 09:20:25 root 46259 Bootup complete Sep 5 09:20:25 vnstatd 85230 SIGTERM received, exiting. Sep 5 09:20:18 arpwatch 870 listening on bxe0.4 Sep 5 09:20:18 arpwatch 529 listening on bxe0.5 Sep 5 09:20:18 arpwatch 67 listening on bxe0 Sep 5 09:20:15 vnstatd 85230 Interface "bce1.40" disabled. Sep 5 09:20:15 vnstatd 85230 Interface "bxe0.30" disabled. Sep 5 09:20:15 vnstatd 85230 Monitoring (17): pppoe0 (1000 Mbit) pfsync0 (1000 Mbit) pflog0 (1000 Mbit) ovpns3 (1000 Mbit) ovpns2 (1000 Mbit) ovpns1 (1000 Mbit) enc0 (1000 Mbit) bxe1 (10000 Mbit) bxe0.69 (10000 Mbit) bxe0.6 (10000 Mbit) bxe0.5 (10000 Mbit) bxe0.4 (10000 Mbit) bxe0.30 (1000 Mbit) bxe0 (10000 Mbit) bce1.40 (1000 Mbit) bce1 (1000 Mbit) bce0 (1000 Mbit) Sep 5 09:20:15 vnstatd 85230 Data retention: 48 5MinuteHours, 4 HourlyDays, 62 DailyDays, 25 MonthlyMonths, -1 YearlyYears, 20 TopDayEntries Sep 5 09:20:15 vnstatd 85230 vnStat daemon 2.12 (pid:85230 uid:0 gid:0, SQLite 3.46.1) Sep 5 09:20:15 kernel pppoe0: promiscuous mode enabled Sep 5 09:20:15 kernel bxe0.4: promiscuous mode enabled Sep 5 09:20:15 kernel bxe0.6: promiscuous mode enabled Sep 5 09:20:15 kernel bxe0.5: promiscuous mode enabled Sep 5 09:20:15 kernel bxe0: promiscuous mode enabled Sep 5 09:20:15 php-cgi 21500 notify_monitor.php: Could not send the message to xxx@me.com -- Error: Failed to connect to smtp.gmail.com:587 [SMTP: Failed to connect socket: php_network_getaddresses: getaddrinfo for smtp.gmail.com failed: Name does not resolve (code: -1, response: )] Sep 5 09:20:15 php-fpm 79579 /rc.start_packages: Skipping STARTing packages process because previous/another instance is already running Sep 5 09:20:14 check_reload_status 495 Reloading filter Sep 5 09:20:14 check_reload_status 495 Starting packages Sep 5 09:20:14 php-fpm 436 /rc.newwanip: pfSense package system has detected an IP change or dynamic WAN reconnection - 107.xxx.xxx.38 -> 66.xxx.xxx.168 - Restarting packages. Sep 5 09:20:13 php-fpm 79579 /rc.newwanip: Interface is unassigned, nothing to do. Sep 5 09:20:13 php-fpm 79579 /rc.newwanip: rc.newwanip: Info: starting on ovpns3. Sep 5 09:20:12 php-fpm 79579 /rc.newwanip: Interface is unassigned, nothing to do. Sep 5 09:20:12 php-fpm 79579 /rc.newwanip: rc.newwanip: Info: starting on ovpns2. Sep 5 09:20:12 php-fpm 79579 /rc.newwanip: Interface is unassigned, nothing to do. Sep 5 09:20:12 php-fpm 79579 /rc.newwanip: rc.newwanip: Info: starting on ovpns1. Sep 5 09:20:12 kernel ovpns3: link state changed to UP Sep 5 09:20:12 check_reload_status 495 rc.newwanip starting ovpns3 Sep 5 09:20:12 php-fpm 436 /rc.newwanip: Creating rrd update script Sep 5 09:20:12 php-fpm 436 OpenVPN PID written: 3194 Sep 5 09:20:11 kernel ovpns3: link state changed to DOWN Sep 5 09:20:11 kernel ovpns2: link state changed to UP Sep 5 09:20:11 php-fpm 436 OpenVPN terminate old pid: 75580 Sep 5 09:20:11 check_reload_status 495 rc.newwanip starting ovpns2 Sep 5 09:20:11 php-fpm 436 OpenVPN PID written: 93147 Sep 5 09:20:11 kernel ovpns2: link state changed to DOWN Sep 5 09:20:11 php-fpm 436 OpenVPN terminate old pid: 65921 Sep 5 09:20:11 kernel ovpns1: link state changed to UP Sep 5 09:20:11 check_reload_status 495 rc.newwanip starting ovpns1 Sep 5 09:20:11 check_reload_status 495 Reloading filter Sep 5 09:20:11 php-fpm 436 OpenVPN PID written: 84119 Sep 5 09:20:11 kernel ovpns1: link state changed to DOWN Sep 5 09:20:11 check_reload_status 495 Reloading filter Sep 5 09:20:11 php-fpm 436 OpenVPN terminate old pid: 58145 Sep 5 09:20:10 php-fpm 436 /rc.newwanip: Resyncing OpenVPN instances for interface WAN. Sep 5 09:20:09 php-fpm 58220 /rc.dyndns.update: Curl error occurred: Could not resolve host: api.cloudflare.com Sep 5 09:20:09 php-fpm 436 /rc.newwanip: Curl error occurred: Could not resolve host: api.cloudflare.com Sep 5 09:19:58 php-fpm 435 /rc.start_packages: Restarting/Starting all packages. Sep 5 09:19:57 sshguard 11504 Now monitoring attacks. Sep 5 09:19:57 syslogd kernel boot file is /boot/kernel/kernel Sep 5 09:19:57 syslogd exiting on signal 15 Sep 5 09:19:57 sshguard 16030 Exiting on signal. Sep 5 09:19:57 sshguard 19169 Exiting on signal. Sep 5 09:19:57 kernel done. Sep 5 09:19:57 php-cgi 542 rc.bootup: Creating rrd update script Sep 5 09:19:57 php-cgi 542 rc.bootup: The command '/usr/bin/nice -n20 /usr/local/bin/rrdtool update /var/db/rrd/system-sensors.rrd N:U:U:U:U:U' returned exit code '1', the output was 'ERROR: /var/db/rrd/system-sensors.rrd: found extra data on update argument: U:U:U:U' Sep 5 09:19:53 kernel done. Sep 5 09:19:53 php-cgi 542 rc.bootup: The command '/usr/local/sbin/strongswanrc stop' returned exit code '1', the output was 'strongswan not running? (check /var/run/daemon-charon.pid).' Sep 5 09:19:53 check_reload_status 495 Updating all dyndns Sep 5 09:19:52 kernel done. Sep 5 09:19:52 php-cgi 542 rc.bootup: NTPD is starting up. Sep 5 09:19:47 php-fpm 436 /rc.newwanip: sync unbound done. Sep 5 09:19:47 php-fpm 436 /rc.newwanip: dhcp6 init complete. Continuing Sep 5 09:19:47 rtsold 68251 RTSOLD Lock in place - sending SIGHUP to dhcp6c Sep 5 09:19:47 rtsold 67556 Received RA specifying route fe80::200:ff:fe00:0 for interface wan(pppoe0) Sep 5 09:19:47 php-fpm 435 /rc.newwanipv6: Gateway, NONE AVAILABLE Sep 5 09:19:47 php-fpm 435 /rc.newwanipv6: Gateway, NONE AVAILABLE Sep 5 09:19:46 php-fpm 436 /rc.newwanip: IP Address has changed, killing states on former IP Address 107.xxx.xxx.38. Sep 5 09:19:46 php-fpm 436 /rc.newwanip: Gateway, none 'available' for inet6, use the first one configured. 'WAN_DHCP6' Sep 5 09:19:46 php-fpm 436 /rc.newwanip: Gateway, none 'available' for inet, use the first one configured. 'WAN_PPPOE' Sep 5 09:19:46 php-fpm 436 /rc.newwanip: dpinger: status socket /var/run/dpinger_WAN_PPPOE~66.xxx.xxx.168~198.xxx.xxx.33.sock not found Sep 5 09:19:46 php-fpm 436 /rc.newwanip: dpinger: status socket /var/run/dpinger_WAN_DHCP6~2606:xxx:xxx:xxx:xxx:xxx:xxx:8660~2606:4700:4700::1111.sock not found Sep 5 09:19:46 php-fpm 435 /rc.newwanipv6: Removing static route for monitor 2606:4700:4700::1111 and adding a new route through pppoe0 Sep 5 09:19:46 php-fpm 435 /rc.newwanipv6: rc.newwanipv6: on (IP address: 2606:xxx:xxx:xxx:xxx:xxx:xxx:8660) (interface: wan) (real interface: pppoe0). Sep 5 09:19:46 php-fpm 435 /rc.newwanipv6: rc.newwanipv6: Info: starting on pppoe0. Sep 5 09:19:46 php-fpm 436 /rc.newwanip: Removing static route for monitor 2606:4700:4700::1111 and adding a new route through pppoe0 Sep 5 09:19:46 php-fpm 436 /rc.newwanip: rc.newwanip: on (IP address: 66.xxx.xxx.168) (interface: WAN[wan]) (real interface: pppoe0). Sep 5 09:19:46 php-fpm 436 /rc.newwanip: rc.newwanip: Info: starting on pppoe0. Sep 5 09:19:45 check_reload_status 495 rc.newwanipv6 starting pppoe0 Sep 5 09:19:45 php-cgi 542 rc.bootup: sync unbound done. Sep 5 09:19:45 check_reload_status 495 rc.newwanip starting pppoe0 Sep 5 09:19:45 php 94545 /usr/local/sbin/ppp-ipv6: Starting rtsold process on wan(pppoe0) Sep 5 09:19:45 php 94545 /usr/local/sbin/ppp-ipv6: Starting DHCP6 client for interfaces pppoe0 Sep 5 09:19:45 php 94545 /usr/local/sbin/ppp-ipv6: Accept router advertisements on interface pppoe0 Sep 5 09:19:44 kernel pppoe0: link state changed to UP Sep 5 09:19:44 kernel bce0: Gigabit link up! Sep 5 09:19:44 php-cgi 542 rc.bootup: Unbound start waiting on dhcp6c. Sep 5 09:19:43 php-cgi 542 rc.bootup: Unbound start waiting on dhcp6c. Sep 5 09:19:42 php-cgi 542 rc.bootup: Unbound start waiting on dhcp6c. Sep 5 09:19:41 php-fpm 436 /rc.linkup: Ignoring link event during boot sequence. Sep 5 09:19:41 php-fpm 435 /rc.linkup: Ignoring link event during boot sequence.
-
If you're seeing that output in the ppp log then you're not using the if_pppoe module.
Did you enable it between those two log entries?
How are you testing? What error(s) are you seeing?
-
@stephenw10 Yes you're correct, I enabled it on sep 5 so the previous logs are using the older module. I'm not sure how to troubleshoot or test. The only thing is when I use if_pppoe the dns resolving stop (even on the host itself).
-
That's using Unbound locally? Testing against something external like?:
[2.8.1-RELEASE][admin@pfsense.fire.box]/root: dig @8.8.8.8 pfsense.org ; <<>> DiG 9.20.6 <<>> @8.8.8.8 pfsense.org ; (1 server found) ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 48941 ;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1 ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 512 ;; QUESTION SECTION: ;pfsense.org. IN A ;; ANSWER SECTION: pfsense.org. 300 IN A 208.123.73.78 ;; Query time: 129 msec ;; SERVER: 8.8.8.8#53(8.8.8.8) (UDP) ;; WHEN: Fri Sep 05 23:18:15 BST 2025 ;; MSG SIZE rcvd: 56
It could an MTU issue. Can you send large pings?
[2.8.1-RELEASE][admin@pfsense.fire.box]/root: ping -4 -s 1472 pfsense.org PING pfsense.org (208.123.73.78): 1472 data bytes 1480 bytes from 208.123.73.78: icmp_seq=0 ttl=47 time=115.757 ms 1480 bytes from 208.123.73.78: icmp_seq=1 ttl=47 time=112.487 ms 1480 bytes from 208.123.73.78: icmp_seq=2 ttl=47 time=112.512 ms
-
@stephenw10 Yes Unbound locally,
Seems large ping doesn't work:
[2.8.1-RELEASE][root@gw.*****.com]/root: ping -4 -s 1472 pfsense.org ping: cannot resolve pfsense.org: Host name lookup failure [2.8.1-RELEASE][root@gw.*****..com]/root: ping -4 8.8.8.8 PING 8.8.8.8 (8.8.8.8): 56 data bytes 64 bytes from 8.8.8.8: icmp_seq=0 ttl=120 time=2.013 ms 64 bytes from 8.8.8.8: icmp_seq=1 ttl=120 time=2.183 ms 64 bytes from 8.8.8.8: icmp_seq=2 ttl=120 time=2.383 ms 64 bytes from 8.8.8.8: icmp_seq=3 ttl=120 time=1.835 ms 64 bytes from 8.8.8.8: icmp_seq=4 ttl=120 time=2.132 ms 64 bytes from 8.8.8.8: icmp_seq=5 ttl=120 time=2.270 ms 64 bytes from 8.8.8.8: icmp_seq=6 ttl=120 time=2.500 ms ^C --- 8.8.8.8 ping statistics --- 7 packets transmitted, 7 packets received, 0.0% packet loss round-trip min/avg/max/stddev = 1.835/2.188/2.500/0.207 msà [2.8.1-RELEASE][root@gw.*****.com]/root: ping -4 -s 1472 8.8.8.8 PING 8.8.8.8 (8.8.8.8): 1472 data bytes ^C --- 8.8.8.8 ping statistics --- 4 packets transmitted, 0 packets received, 100.0% packet loss [2.8.1-RELEASE][root@gw.*****.com]/root: ping -4 -s 1472 208.123.73.78 PING 208.123.73.78 (208.123.73.78): 1472 data bytes ^C --- 208.123.73.78 ping statistics --- 9 packets transmitted, 0 packets received, 100.0% packet loss [2.8.1-RELEASE][root@gw.*****.com]/root: ping -4 208.123.73.78 PING 208.123.73.78 (208.123.73.78): 56 data bytes 64 bytes from 208.123.73.78: icmp_seq=0 ttl=50 time=45.105 ms 64 bytes from 208.123.73.78: icmp_seq=1 ttl=50 time=45.264 ms 64 bytes from 208.123.73.78: icmp_seq=2 ttl=50 time=45.400 ms ^C --- 208.123.73.78 ping statistics --- 3 packets transmitted, 3 packets received, 0.0% packet loss round-trip min/avg/max/stddev = 45.105/45.256/45.400/0.121 ms
[2.8.1-RELEASE][root@gw.*****.com]/root: dig @8.8.8.8 pfsense.org ; <<>> DiG 9.20.6 <<>> @8.8.8.8 pfsense.org ; (1 server found) ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 29501 ;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1 ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 512 ;; QUESTION SECTION: ;pfsense.org. IN A ;; ANSWER SECTION: pfsense.org. 300 IN A 208.123.73.78 ;; Query time: 51 msec ;; SERVER: 8.8.8.8#53(8.8.8.8) (UDP) ;; WHEN: Fri Sep 05 18:51:10 EDT 2025 ;; MSG SIZE rcvd: 56
-
1472 might be too large for your MTU but you should be able to ping at 1400 for example.
Yup sorry 1472 is the largest packet I can send but that's after setting the parent NICs to use 1508 so I can pass full 1500B packets. Most PPPoE connections will top out with the 8B overhead at 1464.
-
Ok since digging an external server does work this seems more like an Unbound issue. Does it stop running? Any errors in the DNS Resolver log?
-
@stephenw10 I just tried using 1400 and it’s giving the same problem.
-
@stephenw10 So pinging in IPv4 i can go up to max of 132. In IPv6 I can do 112 as the size in the ping command. Seems the issue is not the dns resolver.
-
Huh. 132 Bytes total?
What does the interface show the MTU as?
ifconfig pppoe0
-
@stephenw10 Exact 132 bytes
Here's the pppoe info:
[2.8.1-RELEASE][root@gw.*****.com]/root: ifconfig pppoe0 pppoe0: flags=1008951<UP,POINTOPOINT,RUNNING,PROMISC,SIMPLEX,MULTICAST,LOWER_UP> metric 0 mtu 1492 description: WAN options=0 inet 66.xx.xx.50 --> 198.xx.xx.33 netmask 0xffffffff inet6 fe80::xx:xx:xx:8660%pppoe0 prefixlen 64 scopeid 0xd inet6 2606:xx:xx:xx:xx:xx:xx:8660 prefixlen 64 autoconf pltime 604800 vltime 2592000 groups: pppoec nd6 options=123<PERFORMNUD,ACCEPT_RTADV,AUTO_LINKLOCAL,NO_DAD>
-
Hmm. Can you ping the gateway IP with large packets? Or something closer to you in the route?
I've not seen any other report of MTU issues with if_pppoe. I assume if you just disable it and go back to mpd5/netgraph it passes large pings OK?
-
@stephenw10 So to make sure I decided to do a clean install of pfSense 2.8.1. Same issues.
Using mpd5 I can ping with a size of 1464 (with overhead and pppoe I think it's really sends 1500 right?). I tried switching back to if_pppoe and I can ping the IPv4 gateway upto 132bytes + overhead. I also tried pinging the IPv6 gateway using both mpd5 and if_pppoe and it doesn't respond at all, strangely I can ping v6 external servers tho but in if_pppoe I'm limited to a size of 112bytes + overhead. I'm monitoring cloudflare ipv6 dns server instead of the ipv6 gateway since day one and everything seems ok so far.
Any ideas?
[2.8.1-RELEASE][root@gw.******.com]/root: traceroute6 2606:xxxx:xxxx::1111 traceroute6 to 2606:xxxx:xxxx::1111 (2606:xxxx:xxxx::1111) from 2606:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:8660, 64 hops max, 28 byte packets 1 2606:xxxx:xxxx:xxxx::36 (2606:xxxx:xxxx:xxxx::36) 3.733 ms 1.933 ms 1.519 ms 2 2606:xxxx:xxxx:xxxx::3d (2606:xxxx:xxxx:xxxx::3d) 1.667 ms 2.358 ms 3.631 ms 3 * 2400:xxxx:xxxx:xxxx::2 (2400:xxxx:xxxx:xxxx::2) 3.408 ms 2.403 ms 4 2400:xxxx:xxxx:xxxx::xxxx:7dab (2400:xxxx:xxxx:xxxx::xxxx:7dab) 1.939 ms 2400:xxxx:xxxx:xxxx::xxxx:7d7e (2400:xxxx:xxxx:xxxx::xxxx:7d7e) 2.048 ms 2400:xxxx:xxxx:xxxx::xxxx:7d9a (2400:xxxx:xxxx:xxxx::xxxx:7d9a) 2.051 ms [2.8.1-RELEASE][root@gw.******.com]/root: ping -s 112 2606:xxxx:xxxx::1111 PING(160=40+8+112 bytes) 2606:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:8660 --> 2606:xxxx:xxxx::1111 120 bytes from 2606:xxxx:xxxx::1111, icmp_seq=0 hlim=61 time=2.765 ms 120 bytes from 2606:xxxx:xxxx::1111, icmp_seq=1 hlim=61 time=2.316 ms 120 bytes from 2606:xxxx:xxxx::1111, icmp_seq=2 hlim=61 time=2.424 ms 120 bytes from 2606:xxxx:xxxx::1111, icmp_seq=3 hlim=61 time=2.555 ms 120 bytes from 2606:xxxx:xxxx::1111, icmp_seq=4 hlim=61 time=2.540 ms ^C --- 2606:xxxx:xxxx::1111 ping statistics --- 5 packets transmitted, 5 packets received, 0.0% packet loss round-trip min/avg/max/stddev = 2.316/2.520/2.765/0.150 ms [2.8.1-RELEASE][root@gw.******.com]/root: ping -s 112 fe80::xxxx:xxxx:fe00:0%pppoe0 PING(160=40+8+112 bytes) fe80::xxxx:xxxx:xxxx:8660%pppoe0 --> fe80::xxxx:xxxx:fe00:0%pppoe0 ^C --- fe80::xxxx:xxxx:fe00:0%pppoe0 ping statistics --- 10 packets transmitted, 0 packets received, 100.0% packet loss
-
@exomic
The only thing I notice is that you’re using MLPPP with mpd5. I’m not sure whether that could be responsible for such large differences. -
@w0w I’m using Ebox (a child company of Bell Canada). Not sure they support mlppp.
-
Hmm, well that would certainly be an issue, if_pppoe doesn't support mlppp. But I think what you might be seeing is mpd5 just reporting it does support it. It also shows there is only one link in the above log.
But you seem to have proven an issue in your particular setup. I'll see what other tests might be pertinent here.
One thing we discovered recently is that whilst if_pppoe negotiates the MTU/MRU during the connection it doesn't do anything with the result. mpd5 does this correctly. When you use mpd5 hat MTU does the interface end up with?
It's possible your ISP is forcing some low packet size but 132B would be tiny!
-
@stephenw10 By default the wan mtu is 1492 but my isp support baby jumbo frames so I like to set it to 1500 (in ifconfig I see the pppoe mtu at 1500, the vlan interface at 1508 and the raw interface at 1520). Pinging at 1472 (1500 with the overhead) works without any issues using MPD5
-
Are you running any traffic shaping on the WAN?
Check the output of
netstat -I pppoe0 -d
for errors or drops.Lastly try to grab a pcap of the connection negotiation with the ISP in the parent NIC.
-
@stephenw10 I'm not running any traffic shaping at all.
Here's the netstat result:
[2.8.1-RELEASE][root@gw.********.com]/root: netstat -I pppoe0 -d Name Mtu Network Address Ipkts Ierrs Idrop Opkts Oerrs Coll Drop pppoe0 1500 <Link#13> pppoe0 3879 2258 2258 1722 pppoe0 - fe80::%pppoe0/64 fe80::20a:xxxx:xxxx:8660%pppoe0 0 - - 10 - - - pppoe0 - 173.xxx.xxx.29/32 173.xxx.xxx.29 393 - - 21 - - - pppoe0 - 2606:xxxx:xxxx:2f3a::/64 2606:xxxx:xxxx:2f3a:20a:xxxx:xxxx:8660 394 - - 16 -
And the pcap of the pppoe negotiation
16:38:47.347011 PPPoE PADI [Service-Name] [Host-Uniq 0x4680C6A1] [PPP-Max-Payload 0x05DC] 16:38:47.348431 PPPoE PADO [Service-Name] [AC-Name "VDRLPQ5502W"] [Host-Uniq 0x4680C6A1] [AC-Cookie 0x195BD05CD9BE36E411DCFADBD4EDF185] [PPP-Max-Payload 0x05DC] 16:38:47.348434 PPPoE PADR [Service-Name] [AC-Cookie 0x195BD05CD9BE36E411DCFADBD4EDF185] [Host-Uniq 0x4680C6A1] [PPP-Max-Payload 0x05DC] 16:38:47.350558 PPPoE PADS [ses 0x92a] [Service-Name] [Host-Uniq 0x4680C6A1] [PPP-Max-Payload 0x05DC] 16:38:47.350562 PPPoE [ses 0x92a] LCP, Conf-Request (0x01), id 1, length 12 16:38:47.351004 PPPoE [ses 0x92a] LCP, Conf-Request (0x01), id 111, length 20 16:38:47.351006 PPPoE [ses 0x92a] LCP, Conf-Ack (0x02), id 111, length 20 16:38:47.352703 PPPoE [ses 0x92a] LCP, Conf-Ack (0x02), id 1, length 12 16:38:47.352707 PPPoE [ses 0x92a] PAP, Auth-Req (0x01), id 2, Peer REDACTED@pppoe.ebox.net, Name REDACTED 16:38:47.739573 PPPoE [ses 0x92a] LCP, Conf-Request (0x01), id 3, length 17 16:38:47.739582 PPPoE [ses 0x92a] LCP, Conf-Ack (0x02), id 3, length 17 16:38:47.739588 PPPoE [ses 0x92a] LCP, Conf-Request (0x01), id 3, length 12 16:38:47.741720 PPPoE [ses 0x92a] LCP, Conf-Ack (0x02), id 3, length 12 16:38:47.741745 PPPoE [ses 0x92a] CHAP, Challenge (0x01), id 185, Value REDACTED, Name JUNOS 16:38:47.741749 PPPoE [ses 0x92a] CHAP, Response (0x02), id 185, Value REDACTED, Name REDACTED@pppoe.ebox.net 16:38:47.961651 PPPoE [ses 0x92a] CHAP, Success (0x03), id 185, Msg 16:38:47.961663 PPPoE [ses 0x92a] IPCP, Conf-Request (0x01), id 4, length 24 16:38:47.961666 PPPoE [ses 0x92a] IP6 :: > ff02::16: ICMP6, multicast listener report v2, 1 group record(s), length 28 16:38:47.961667 PPPoE [ses 0x92a] IP6 :: > ff02::16: ICMP6, multicast listener report v2, 1 group record(s), length 28 16:38:47.961669 PPPoE [ses 0x92a] IP6CP, Conf-Request (0x01), id 5, length 16 16:38:47.964889 PPPoE [ses 0x92a] IPCP, Conf-Request (0x01), id 120, length 12 16:38:47.964893 PPPoE [ses 0x92a] IPCP, Conf-Ack (0x02), id 120, length 12 16:38:47.965091 PPPoE [ses 0x92a] IPCP, Conf-Nack (0x03), id 4, length 24 16:38:47.965092 PPPoE [ses 0x92a] IPCP, Conf-Request (0x01), id 6, length 24 16:38:48.112866 PPPoE [ses 0x92a] IP6 :: > ff02::16: ICMP6, multicast listener report v2, 2 group record(s), length 48 16:38:48.121018 PPPoE [ses 0x92a] IPCP, Conf-Ack (0x02), id 6, length 24 16:38:48.121041 PPPoE [ses 0x92a] IP6CP, Conf-Request (0x01), id 10, length 16 16:38:48.121045 PPPoE [ses 0x92a] IP6CP, Conf-Ack (0x02), id 10, length 16 16:38:48.121216 PPPoE [ses 0x92a] IP6CP, Conf-Ack (0x02), id 5, length 16 16:38:48.210937 PPPoE [ses 0x92a] IP 173.xxx.xxx.246.30963 > 1.1.1.1.853: tcp 0 16:38:48.211237 PPPoE [ses 0x92a] IP6 2606:xxxx:xxxx:2c00::1.35795 > 2606:xxxx:xxxx::1111.853: tcp 0 16:38:48.212934 PPPoE [ses 0x92a] IP 1.1.1.1.853 > 173.xxx.xxx.246.30963: tcp 0 16:38:48.212957 PPPoE [ses 0x92a] IP 173.xxx.xxx.246.30963 > 1.1.1.1.853: tcp 0 16:38:48.213396 PPPoE [ses 0x92a] IP 173.xxx.xxx.246.30963 > 1.1.1.1.853: tcp 324 16:38:48.215935 PPPoE [ses 0x92a] IP 1.1.1.1.853 > 173.xxx.xxx.246.30963: tcp 0 16:38:48.216404 PPPoE [ses 0x92a] IP 1.1.1.1.853 > 173.xxx.xxx.246.30963: tcp 1448 16:38:48.216406 PPPoE [ses 0x92a] IP 1.1.1.1.853 > 173.xxx.xxx.246.30963: tcp 1448 16:38:48.216407 PPPoE [ses 0x92a] IP 1.1.1.1.853 > 173.xxx.xxx.246.30963: tcp 1268 16:38:48.223016 PPPoE [ses 0x92a] IP 1.1.1.1.853 > 173.xxx.xxx.246.30963: tcp 1268 16:38:48.257783 PPPoE [ses 0x92a] IP6 fe80::200:ff:fe00:0 > ff02::1: ICMP6, router advertisement, length 88 16:38:48.351853 PPPoE [ses 0x92a] PAP, Auth-Req (0x01), id 7, Peer REDACTED@pppoe.ebox.net, Name REDACTED 16:38:48.392359 PPPoE [ses 0x92a] IP6 2606:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:861f.51857 > 2a00:xxxx:xxxx:xxxx::2003.443: tcp 0 16:38:48.431076 PPPoE [ses 0x92a] IP 1.1.1.1.853 > 173.xxx.xxx.246.30963: tcp 1448 16:38:48.480197 PPPoE [ses 0x92a] IP 173.xxx.xxx.246.7296 > 1.1.1.1.853: tcp 0 16:38:48.480263 PPPoE [ses 0x92a] IP6 2606:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:8660.53355 > 2606:xxxx:xxxx::1001.853: tcp 0 16:38:48.482181 PPPoE [ses 0x92a] IP 1.1.1.1.853 > 173.xxx.xxx.246.7296: tcp 0 16:38:48.482201 PPPoE [ses 0x92a] IP 173.xxx.xxx.246.7296 > 1.1.1.1.853: tcp 0 16:38:48.482532 PPPoE [ses 0x92a] IP 173.xxx.xxx.246.7296 > 1.1.1.1.853: tcp 324 16:38:48.484929 PPPoE [ses 0x92a] IP 1.1.1.1.853 > 173.xxx.xxx.246.7296: tcp 0 16:38:48.485288 PPPoE [ses 0x92a] IP 1.1.1.1.853 > 173.xxx.xxx.246.7296: tcp 1448 16:38:48.485290 PPPoE [ses 0x92a] IP 1.1.1.1.853 > 173.xxx.xxx.246.7296: tcp 1448 16:38:48.485320 PPPoE [ses 0x92a] IP 1.1.1.1.853 > 173.xxx.xxx.246.7296: tcp 1267 16:38:48.494859 PPPoE [ses 0x92a] IP 1.1.1.1.853 > 173.xxx.xxx.246.7296: tcp 1267 16:38:48.512954 PPPoE [ses 0x92a] IP 10.10.6.10.51746 > 13.xxx.xxx.123.443: tcp 0 16:38:48.517870 PPPoE [ses 0x92a] IP 173.xxx.xxx.246.63607 > 1.1.1.1.853: tcp 0 16:38:48.520057 PPPoE [ses 0x92a] IP 1.1.1.1.853 > 173.xxx.xxx.246.63607: tcp 0 16:38:48.520079 PPPoE [ses 0x92a] IP 173.xxx.xxx.246.63607 > 1.1.1.1.853: tcp 0 16:38:48.520401 PPPoE [ses 0x92a] IP 173.xxx.xxx.246.63607 > 1.1.1.1.853: tcp 324 16:38:48.523181 PPPoE [ses 0x92a] IP 1.1.1.1.853 > 173.xxx.xxx.246.63607: tcp 0 16:38:48.524074 PPPoE [ses 0x92a] IP 1.1.1.1.853 > 173.xxx.xxx.246.63607: tcp 1448 16:38:48.524076 PPPoE [ses 0x92a] IP 1.1.1.1.853 > 173.xxx.xxx.246.63607: tcp 1448 16:38:48.524077 PPPoE [ses 0x92a] IP 1.1.1.1.853 > 173.xxx.xxx.246.63607: tcp 1268 16:38:48.533299 PPPoE [ses 0x92a] IP 1.1.1.1.853 > 173.xxx.xxx.246.63607: tcp 1268 16:38:48.700950 PPPoE [ses 0x92a] IP 1.1.1.1.853 > 173.xxx.xxx.246.7296: tcp 1448 16:38:48.707667 PPPoE [ses 0x92a] IP 10.10.6.102.34645 > 142.xxx.xxx.99.443: tcp 0 16:38:48.742329 PPPoE [ses 0x92a] IP 1.1.1.1.853 > 173.xxx.xxx.246.63607: tcp 1448 16:38:48.839075 PPPoE [ses 0x92a] IP 1.1.1.1.853 > 173.xxx.xxx.246.30963: tcp 1448 16:38:48.882533 PPPoE [ses 0x92a] IP6 2606:xxxx:xxxx:2c00:xxxx:xxxx:xxxx:e0c6.64561 > 2606:xxxx:xxxx::xxxx:8969.443: tcp 0 16:38:49.108952 PPPoE [ses 0x92a] IP 1.1.1.1.853 > 173.xxx.xxx.246.7296: tcp 1448 16:38:49.140987 PPPoE [ses 0x92a] IP6 fe80::20a:f7ff:fe49:8660.546 > ff02::1:2.547: UDP, length 81 16:38:49.159327 PPPoE [ses 0x92a] IP 1.1.1.1.853 > 173.xxx.xxx.246.63607: tcp 1448 16:38:49.210866 PPPoE [ses 0x92a] IP6 2606:xxxx:xxxx:2c00::1.35795 > 2606:xxxx:xxxx::1111.853: tcp 0 16:38:49.275807 PPPoE [ses 0x92a] IP 207.xx.xx.10.1702 > 173.xxx.xxx.246.9051: tcp 0 16:38:49.349232 PPPoE [ses 0x92a] IP6 fe80::200:ff:fe00:0.547 > fe80::20a:f7ff:fe49:8660.546: UDP, length 133 16:38:49.383193 PPPoE [ses 0x92a] IP 173.xxx.xxx.246.30963 > 1.1.1.1.853: tcp 0 16:38:49.386172 PPPoE [ses 0x92a] IP 173.xxx.xxx.246.63607 > 1.1.1.1.853: tcp 0 16:38:49.389088 PPPoE [ses 0x92a] IP6 2606:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:861f.51857 > 2a00:xxxx:xxxx:xxxx::2003.443: tcp 0 16:38:49.389247 PPPoE [ses 0x92a] IP 173.xxx.xxx.246.7296 > 1.1.1.1.853: tcp 0 16:38:49.427059 PPPoE [ses 0x92a] IP 1.1.1.1.853 > 173.xxx.xxx.246.30963: tcp 0 16:38:49.429306 PPPoE [ses 0x92a] IP 1.1.1.1.853 > 173.xxx.xxx.246.63607: tcp 0 16:38:49.432933 PPPoE [ses 0x92a] IP 1.1.1.1.853 > 173.xxx.xxx.246.7296: tcp 0 16:38:49.455807 PPPoE [ses 0x92a] IP6 2606:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:8660.17775 > 2606:xxxx:xxxx::1001.853: tcp 0 16:38:49.455875 PPPoE [ses 0x92a] IP6 2606:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:8660.57686 > 2606:xxxx:xxxx::1001.853: tcp 0 16:38:49.455944 PPPoE [ses 0x92a] IP 173.xxx.xxx.246.4551 > 1.1.1.1.853: tcp 0 16:38:49.457987 PPPoE [ses 0x92a] IP 1.1.1.1.853 > 173.xxx.xxx.246.4551: tcp 0 16:38:49.458009 PPPoE [ses 0x92a] IP 173.xxx.xxx.246.4551 > 1.1.1.1.853: tcp 0 16:38:49.458017 PPPoE [ses 0x92a] IP6 2606:xxxx:xxxx::1001.853 > 2606:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:8660.57686: tcp 0 16:38:49.458041 PPPoE [ses 0x92a] IP6 2606:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:8660.57686 > 2606:xxxx:xxxx::1001.853: tcp 0 16:38:49.458057 PPPoE [ses 0x92a] IP6 2606:xxxx:xxxx::1001.853 > 2606:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:8660.17775: tcp 0 16:38:49.458078 PPPoE [ses 0x92a] IP6 2606:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:8660.17775 > 2606:xxxx:xxxx::1001.853: tcp 0 16:38:49.458265 PPPoE [ses 0x92a] IP6 2606:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:8660.57686 > 2606:xxxx:xxxx::1001.853: tcp 324 16:38:49.458269 PPPoE [ses 0x92a] IP 173.xxx.xxx.246.4551 > 1.1.1.1.853: tcp 324 16:38:49.458313 PPPoE [ses 0x92a] IP6 2606:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:8660.17775 > 2606:xxxx:xxxx::1001.853: tcp 324 16:38:49.460936 PPPoE [ses 0x92a] IP 1.1.1.1.853 > 173.xxx.xxx.246.4551: tcp 0 16:38:49.460938 PPPoE [ses 0x92a] IP6 2606:xxxx:xxxx::1001.853 > 2606:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:8660.17775: tcp 0 16:38:49.460976 PPPoE [ses 0x92a] IP6 2606:xxxx:xxxx::1001.853 > 2606:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:8660.57686: tcp 0 16:38:49.461374 PPPoE [ses 0x92a] IP 1.1.1.1.853 > 173.xxx.xxx.246.4551: tcp 1448 16:38:49.461376 PPPoE [ses 0x92a] IP 1.1.1.1.853 > 173.xxx.xxx.246.4551: tcp 1448 16:38:49.461377 PPPoE [ses 0x92a] IP 1.1.1.1.853 > 173.xxx.xxx.246.4551: tcp 1267 16:38:49.461496 PPPoE [ses 0x92a] IP6 2606:xxxx:xxxx::1001.853 > 2606:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:8660.57686: tcp 1348 16:38:49.461498 PPPoE [ses 0x92a] IP6 2606:xxxx:xxxx::1001.853 > 2606:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:8660.57686: tcp 1348 16:38:49.461501 PPPoE [ses 0x92a] IP6 2606:xxxx:xxxx::1001.853 > 2606:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:8660.57686: tcp 1348 16:38:49.461560 PPPoE [ses 0x92a] IP6 2606:xxxx:xxxx::1001.853 > 2606:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:8660.57686: tcp 119 16:38:49.462323 PPPoE [ses 0x92a] IP6 2606:xxxx:xxxx::1001.853 > 2606:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:8660.17775: tcp 1348 16:38:49.462352 PPPoE [ses 0x92a] IP6 2606:xxxx:xxxx::1001.853 > 2606:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:8660.17775: tcp 1348 16:38:49.462355 PPPoE [ses 0x92a] IP6 2606:xxxx:xxxx::1001.853 > 2606:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:8660.17775: tcp 1348 16:38:49.462356 PPPoE [ses 0x92a] IP6 2606:xxxx:xxxx::1001.853 > 2606:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:8660.17775: tcp 120 16:38:49.469059 PPPoE [ses 0x92a] IP 1.1.1.1.853 > 173.xxx.xxx.246.4551: tcp 1267 16:38:49.470454 PPPoE [ses 0x92a] IP6 2606:xxxx:xxxx::1001.853 > 2606:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:8660.57686: tcp 119 16:38:49.471142 PPPoE [ses 0x92a] IP6 2606:xxxx:xxxx::1001.853 > 2606:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:8660.17775: tcp 120 16:38:49.481293 PPPoE [ses 0x92a] IP6 2606:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:8660.3938 > 2606:xxxx:xxxx::1111.853: tcp 0 16:38:49.481295 PPPoE [ses 0x92a] IP 173.xxx.xxx.246.9924 > 1.1.1.1.853: tcp 0 16:38:49.483338 PPPoE [ses 0x92a] IP 1.1.1.1.853 > 173.xxx.xxx.246.9924: tcp 0 16:38:49.483371 PPPoE [ses 0x92a] IP 173.xxx.xxx.246.9924 > 1.1.1.1.853: tcp 0 16:38:49.483433 PPPoE [ses 0x92a] IP6 2606:xxxx:xxxx::1111.853 > 2606:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:8660.3938: tcp 0 16:38:49.483461 PPPoE [ses 0x92a] IP6 2606:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:8660.3938 > 2606:xxxx:xxxx::1111.853: tcp 0 16:38:49.483671 PPPoE [ses 0x92a] IP 173.xxx.xxx.246.9924 > 1.1.1.1.853: tcp 324 16:38:49.483735 PPPoE [ses 0x92a] IP6 2606:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:8660.3938 > 2606:xxxx:xxxx::1111.853: tcp 324 16:38:49.485985 PPPoE [ses 0x92a] IP 1.1.1.1.853 > 173.xxx.xxx.246.9924: tcp 0 16:38:49.486057 PPPoE [ses 0x92a] IP6 2606:xxxx:xxxx::1111.853 > 2606:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:8660.3938: tcp 0 16:38:49.486435 PPPoE [ses 0x92a] IP6 2606:xxxx:xxxx::1111.853 > 2606:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:8660.3938: tcp 1348 16:38:49.486439 PPPoE [ses 0x92a] IP6 2606:xxxx:xxxx::1111.853 > 2606:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:8660.3938: tcp 1348 16:38:49.486440 PPPoE [ses 0x92a] IP6 2606:xxxx:xxxx::1111.853 > 2606:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:8660.3938: tcp 1348 16:38:49.486442 PPPoE [ses 0x92a] IP6 2606:xxxx:xxxx::1111.853 > 2606:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:8660.3938: tcp 119 16:38:49.486520 PPPoE [ses 0x92a] IP 1.1.1.1.853 > 173.xxx.xxx.246.9924: tcp 1448 16:38:49.486523 PPPoE [ses 0x92a] IP 1.1.1.1.853 > 173.xxx.xxx.246.9924: tcp 1448 16:38:49.486525 PPPoE [ses 0x92a] IP 1.1.1.1.853 > 173.xxx.xxx.246.9924: tcp 1267 16:38:49.495439 PPPoE [ses 0x92a] IP 1.1.1.1.853 > 173.xxx.xxx.246.9924: tcp 1267 16:38:49.496070 PPPoE [ses 0x92a] IP6 2606:xxxx:xxxx::1001.853 > 2606:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:8660.53355: tcp 0 16:38:49.496311 PPPoE [ses 0x92a] IP6 2606:xxxx:xxxx::1111.853 > 2606:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:8660.3938: tcp 119 16:38:49.498368 PPPoE [ses 0x92a] IP6 2606:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:8660 > 2606:xxxx:xxxx::1111: ICMP6, echo request, id 31466, seq 0, length 9 16:38:49.499896 PPPoE [ses 0x92a] IP 173.xxx.xxx.246 > 198.xx.xx.34: ICMP echo request, id 31707, seq 0, length 9 16:38:49.501408 PPPoE [ses 0x92a] IP6 2606:xxxx:xxxx::1111 > 2606:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:8660: ICMP6, echo reply, id 31466, seq 0, length 9 16:38:49.501916 PPPoE [ses 0x92a] IP 198.xx.xx.34 > 173.xxx.xxx.246: ICMP echo reply, id 31707, seq 0, length 9 16:38:49.505611 PPPoE [ses 0x92a] IP 10.10.6.10.51746 > 13.xxx.xxx.123.443: tcp 0 16:38:49.654859 PPPoE [ses 0x92a] IP6 2606:xxxx:xxxx:2c00:xxxx:xxxx:xxxx:e0c6.64562 > 2606:xxxx:xxxx::xxxx:8969.443: tcp 0 16:38:49.676201 PPPoE [ses 0x92a] IP 1.1.1.1.853 > 173.xxx.xxx.246.4551: tcp 1448 16:38:49.680324 PPPoE [ses 0x92a] IP6 2606:xxxx:xxxx::1001.853 > 2606:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:8660.17775: tcp 1348 16:38:49.681823 PPPoE [ses 0x92a] IP6 2606:xxxx:xxxx::1001.853 > 2606:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:8660.57686: tcp 1348 16:38:49.705451 PPPoE [ses 0x92a] IP6 2606:xxxx:xxxx::1111.853 > 2606:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:8660.3938: tcp 1348 16:38:49.707574 PPPoE [ses 0x92a] IP 1.1.1.1.853 > 173.xxx.xxx.246.9924: tcp 1448 16:38:49.712731 PPPoE [ses 0x92a] IP 10.10.6.102.34645 > 142.xxx.xxx.99.443: tcp 0 16:38:49.831178 PPPoE [ses 0x92a] IP6 2a00:xxxx:xxxx:xxxx::2003.443 > 2606:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:861f.51857: tcp 0 16:38:49.834091 PPPoE [ses 0x92a] IP6 2606:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:861f.51857 > 2a00:xxxx:xxxx:xxxx::2003.443: tcp 0 16:38:49.837630 PPPoE [ses 0x92a] IP6 2606:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:861f.51857 > 2a00:xxxx:xxxx:xxxx::2003.443: tcp 517 16:38:49.974266 PPPoE [ses 0x92a] IP6 2a00:xxxx:xxxx:xxxx::2003.443 > 2606:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:861f.51857: tcp 0 16:38:49.975822 PPPoE [ses 0x92a] IP6 2606:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:8660 > 2606:xxxx:xxxx::1111: ICMP6, echo request, id 5854, seq 0, length 9 16:38:49.977522 PPPoE [ses 0x92a] IP 173.xxx.xxx.246 > 198.xx.xx.34: ICMP echo request, id 6138, seq 0, length 9 16:38:49.977944 PPPoE [ses 0x92a] IP6 2606:xxxx:xxxx::1111 > 2606:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:8660: ICMP6, echo reply, id 5854, seq 0, length 9 16:38:49.986604 PPPoE [ses 0x92a] IP 173.xxx.xxx.246.9924 > 1.1.1.1.853: tcp 0 16:38:49.986685 PPPoE [ses 0x92a] IP6 2606:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:8660.57686 > 2606:xxxx:xxxx::1001.853: tcp 0 16:38:49.987213 PPPoE [ses 0x92a] IP 198.xx.xx.34 > 173.xxx.xxx.246: ICMP echo reply, id 6138, seq 0, length 9 16:38:49.989261 PPPoE [ses 0x92a] IP6 2606:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:8660.3938 > 2606:xxxx:xxxx::1111.853: tcp 0 16:38:49.991877 PPPoE [ses 0x92a] IP6 2606:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:8660.17775 > 2606:xxxx:xxxx::1001.853: tcp 0 16:38:49.994465 PPPoE [ses 0x92a] IP 173.xxx.xxx.246.4551 > 1.1.1.1.853: tcp 0 16:38:50.024857 PPPoE [ses 0x92a] IP6 2a00:xxxx:xxxx:xxxx::2003.443 > 2606:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:861f.51832: tcp 1208 16:38:50.027071 PPPoE [ses 0x92a] IP6 2a00:xxxx:xxxx:xxxx::2003.443 > 2606:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:861f.51857: tcp 1208 16:38:50.027075 PPPoE [ses 0x92a] IP6 2a00:xxxx:xxxx:xxxx::2003.443 > 2606:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:861f.51857: tcp 1208 16:38:50.027077 PPPoE [ses 0x92a] IP6 2a00:xxxx:xxxx:xxxx::2003.443 > 2606:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:861f.51857: tcp 1208 16:38:50.027079 PPPoE [ses 0x92a] IP6 2a00:xxxx:xxxx:xxxx::2003.443 > 2606:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:861f.51857: tcp 507 16:38:50.029432 PPPoE [ses 0x92a] IP 1.1.1.1.853 > 173.xxx.xxx.246.9924: tcp 0 16:38:50.030441 PPPoE [ses 0x92a] IP6 2606:xxxx:xxxx::1001.853 > 2606:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:8660.57686: tcp 0 16:38:50.032318 PPPoE [ses 0x92a] IP6 2606:xxxx:xxxx::1111.853 > 2606:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:8660.3938: tcp 0 16:38:50.034213 PPPoE [ses 0x92a] IP6 2606:xxxx:xxxx::1001.853 > 2606:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:8660.17775: tcp 0 16:38:50.038057 PPPoE [ses 0x92a] IP 1.1.1.1.853 > 173.xxx.xxx.246.4551: tcp 0 16:38:50.084076 PPPoE [ses 0x92a] IP 1.1.1.1.853 > 173.xxx.xxx.246.4551: tcp 1448 16:38:50.088323 PPPoE [ses 0x92a] IP6 2606:xxxx:xxxx::1001.853 > 2606:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:8660.17775: tcp 1348 16:38:50.090573 PPPoE [ses 0x92a] IP6 2606:xxxx:xxxx::1001.853 > 2606:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:8660.57686: tcp 1348 16:38:50.113449 PPPoE [ses 0x92a] IP6 2606:xxxx:xxxx::1111.853 > 2606:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:8660.3938: tcp 1348 16:38:50.114453 PPPoE [ses 0x92a] IP 1.1.1.1.853 > 173.xxx.xxx.246.9924: tcp 1448 16:38:50.239779 PPPoE [ses 0x92a] IP6 fe80::20a:f7ff:fe49:8660.546 > ff02::1:2.547: UDP, length 81 16:38:50.243990 PPPoE [ses 0x92a] IP6 fe80::200:ff:fe00:0.547 > fe80::20a:f7ff:fe49:8660.546: UDP, length 133 16:38:50.311065 PPPoE [ses 0x92a] IP6 2a00:xxxx:xxxx:xxxx::2003.443 > 2606:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:861f.51857: tcp 507 16:38:50.333518 PPPoE [ses 0x92a] IP6 2606:xxxx:xxxx:2c00:xxxx:xxxx:xxxx:e0c6.64578 > 2606:xxxx:xxxx::xxxx:8969.443: tcp 0 16:38:50.336556 PPPoE [ses 0x92a] IP6 2606:xxxx:xxxx::xxxx:8969.443 > 2606:xxxx:xxxx:2c00:xxxx:xxxx:xxxx:e0c6.64578: tcp 0 16:38:50.336817 PPPoE [ses 0x92a] IP6 2606:xxxx:xxxx:2c00:xxxx:xxxx:xxxx:e0c6.64578 > 2606:xxxx:xxxx::xxxx:8969.443: tcp 0 16:38:50.337103 PPPoE [ses 0x92a] IP6 2606:xxxx:xxxx:2c00:xxxx:xxxx:xxxx:e0c6.64578 > 2606:xxxx:xxxx::xxxx:8969.443: tcp 286 16:38:50.340056 PPPoE [ses 0x92a] IP6 2606:xxxx:xxxx::xxxx:8969.443 > 2606:xxxx:xxxx:2c00:xxxx:xxxx:xxxx:e0c6.64578: tcp 0 16:38:50.341915 PPPoE [ses 0x92a] IP6 2606:xxxx:xxxx::xxxx:8969.443 > 2606:xxxx:xxxx:2c00:xxxx:xxxx:xxxx:e0c6.64578: tcp 1360 16:38:50.341917 PPPoE [ses 0x92a] IP6 2606:xxxx:xxxx::xxxx:8969.443 > 2606:xxxx:xxxx:2c00:xxxx:xxxx:xxxx:e0c6.64578: tcp 1360 16:38:50.341944 PPPoE [ses 0x92a] IP6 2606:xxxx:xxxx::xxxx:8969.443 > 2606:xxxx:xxxx:2c00:xxxx:xxxx:xxxx:e0c6.64578: tcp 508 16:38:50.349749 PPPoE [ses 0x92a] IP6 2606:xxxx:xxxx::xxxx:8969.443 > 2606:xxxx:xxxx:2c00:xxxx:xxxx:xxxx:e0c6.64578: tcp 508 16:38:50.475866 PPPoE [ses 0x92a] IP6 2606:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:8660 > 2606:xxxx:xxxx::1111: ICMP6, echo request, id 5854, seq 1, length 9 16:38:50.477926 PPPoE [ses 0x92a] IP6 2606:xxxx:xxxx::1111 > 2606:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:8660: ICMP6, echo reply, id 5854, seq 1, length 9 16:38:50.480860 PPPoE [ses 0x92a] IP 173.xxx.xxx.246 > 198.xx.xx.34: ICMP echo request, id 6138, seq 1, length 9 16:38:50.482607 PPPoE [ses 0x92a] IP 198.xx.xx.34 > 173.xxx.xxx.246: ICMP echo reply, id 6138, seq 1, length 9 16:38:50.559827 PPPoE [ses 0x92a] IP6 2606:xxxx:xxxx::xxxx:8969.443 > 2606:xxxx:xxxx:2c00:xxxx:xxxx:xxxx:e0c6.64578: tcp 1360 16:38:50.734051 PPPoE [ses 0x92a] IP6 2a00:xxxx:xxxx:xxxx::2003.443 > 2606:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:861f.51857: tcp 1208 16:38:50.891003 PPPoE [ses 0x92a] IP6 2606:xxxx:xxxx:xxxx:xxxx:xxxx:fe49:8660.21016 > 2606:xxxx:xxxx::1001.853: tcp 0 16:38:50.891014 PPPoE [ses 0x92a] IP6 2606:xxxx:xxxx:xxxx:xxxx:xxxx:fe49:8660.60724 > 2606:xxxx:xxxx::1111.853: tcp 0 16:38:50.966822 PPPoE [ses 0x92a] IP6 2606:xxxx:xxxx::xxxx:8969.443 > 2606:xxxx:xxxx:2c00:xxxx:xxxx:xxxx:e0c6.64578: tcp 1360 16:38:50.977862 PPPoE [ses 0x92a] IP6 2606:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:8660 > 2606:xxxx:xxxx::1111: ICMP6, echo request, id 5854, seq 2, length 9 16:38:50.979901 PPPoE [ses 0x92a] IP6 2606:xxxx:xxxx::1111 > 2606:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:8660: ICMP6, echo reply, id 5854, seq 2, length 9 16:38:50.981856 PPPoE [ses 0x92a] IP 173.xxx.xxx.246 > 198.xx.xx.34: ICMP echo request, id 6138, seq 2, length 9 16:38:50.983782 PPPoE [ses 0x92a] IP 198.xx.xx.34 > 173.xxx.xxx.246: ICMP echo reply, id 6138, seq 2, length 9 16:38:51.027530 PPPoE [ses 0x92a] IP6 fe80::20a:f7ff:fe49:8660 > ff02::2: ICMP6, router solicitation, length 8 16:38:51.029905 PPPoE [ses 0x92a] IP6 fe80::200:ff:fe00:0 > ff02::1: ICMP6, router advertisement, length 88 16:38:51.156471 PPPoE [ses 0x92a] IP6 fe80::20a:f7ff:fe49:8660.546 > ff02::1:2.547: UDP, length 81 16:38:51.159187 PPPoE [ses 0x92a] IP6 fe80::200:ff:fe00:0.547 > fe80::20a:f7ff:fe49:8660.546: UDP, length 133 16:38:51.307098 PPPoE [ses 0x92a] IP6 2606:xxxx:xxxx:2c00:xxxx:xxxx:xxxx:e0c6.64567 > 2001:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:af43.7680: tcp 0 16:38:51.478866 PPPoE [ses 0x92a] IP6 2606:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:8660 > 2606:xxxx:xxxx::1111: ICMP6, echo request, id 5854, seq 3, length 9 16:38:51.480905 PPPoE [ses 0x92a] IP6 2606:xxxx:xxxx::1111 > 2606:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:8660: ICMP6, echo reply, id 5854, seq 3, length 9 16:38:51.487127 PPPoE [ses 0x92a] IP 173.xxx.xxx.246 > 198.xx.xx.34: ICMP echo request, id 6138, seq 3, length 9 16:38:51.487837 PPPoE [ses 0x92a] IP 173.xxx.xxx.246.33426 > 1.1.1.1.853: tcp 0 16:38:51.487837 PPPoE [ses 0x92a] IP 173.xxx.xxx.246.12118 > 1.1.1.1.853: tcp 0 16:38:51.489979 PPPoE [ses 0x92a] IP 198.xx.xx.34 > 173.xxx.xxx.246: ICMP echo reply, id 6138, seq 3, length 9 16:38:51.490281 PPPoE [ses 0x92a] IP 1.1.1.1.853 > 173.xxx.xxx.246.12118: tcp 0 16:38:51.490282 PPPoE [ses 0x92a] IP 1.1.1.1.853 > 173.xxx.xxx.246.33426: tcp 0 16:38:51.490298 PPPoE [ses 0x92a] IP 173.xxx.xxx.246.12118 > 1.1.1.1.853: tcp 0 16:38:51.490298 PPPoE [ses 0x92a] IP 173.xxx.xxx.246.33426 > 1.1.1.1.853: tcp 0 16:38:51.490747 PPPoE [ses 0x92a] IP 173.xxx.xxx.246.12118 > 1.1.1.1.853: tcp 324 16:38:51.490748 PPPoE [ses 0x92a] IP 173.xxx.xxx.246.33426 > 1.1.1.1.853: tcp 324 16:38:51.492931 PPPoE [ses 0x92a] IP 1.1.1.1.853 > 173.xxx.xxx.246.12118: tcp 0 16:38:51.493057 PPPoE [ses 0x92a] IP 1.1.1.1.853 > 173.xxx.xxx.246.33426: tcp 0 16:38:51.493594 PPPoE [ses 0x92a] IP 1.1.1.1.853 > 173.xxx.xxx.246.33426: tcp 1448 16:38:51.493597 PPPoE [ses 0x92a] IP 1.1.1.1.853 > 173.xxx.xxx.246.33426: tcp 1448 16:38:51.493599 PPPoE [ses 0x92a] IP 1.1.1.1.853 > 173.xxx.xxx.246.33426: tcp 1269 16:38:51.493885 PPPoE [ses 0x92a] IP 1.1.1.1.853 > 173.xxx.xxx.246.12118: tcp 1448 16:38:51.493886 PPPoE [ses 0x92a] IP 1.1.1.1.853 > 173.xxx.xxx.246.12118: tcp 1448 16:38:51.493887 PPPoE [ses 0x92a] IP 1.1.1.1.853 > 173.xxx.xxx.246.12118: tcp 1268 16:38:51.502386 PPPoE [ses 0x92a] IP 1.1.1.1.853 > 173.xxx.xxx.246.33426: tcp 1269 16:38:51.502811 PPPoE [ses 0x92a] IP 1.1.1.1.853 > 173.xxx.xxx.246.12118: tcp 1268
-
Hmm, nothing obvious there. It sure looks to be trying to use 1500B.
I see plenty on incoming large size packets too but also the Idrop counter being huge.....
Are you able to upload the pcap itself to us for analysis?
Do you see any large outgoing packets at all? Maybe outside the PPPoE stream?