19

As far as I understand, PPPoE operates over ethernet, so for PPPoE to be usable you should already be able to send Ethernet frames to your ISP.

At that point, why use PPPoE at all? Why not just run IP directly over that Ethernet-like link, assign an IP via DHCP and be done with it?

5 Answers 5

15

Another reason may be that PPPoE is a tunnelling protocol which is useful for security and hiding an ISPs infrastructure. A tunnel is created between the end user CPE and ISP’s centralised BRAS. The network in-between is hidden from the user and the user cannot interact with other users directly over the ISP’s distribution network until it reaches the BRAS where policy may be enforced.

This is also useful where the connection to an end user passes over another service provider’s network before it reaches the contracted ISP. The tunnel can make it appear as though there is a direct connection to the contracted ISP. For example, in the UK, BT are regulated by the government and must provide wholesale services to other ISPs. An ISP will buy a DSL connection to an end user’s home from BT and BT will backhaul the connection to the ISP at a handover point. The ISP then provides connectivity to the Internet, DNS, email etc. The PPPoE tunnel hides all of this complexity from the user. All they see is a single hop to their ISP.

11

A few reasons.

Firstly that is just the way it has always been and ISPs are loath to change a working setup.

Secondly it's possible to create translators between different types of PPP. Just because what your router sees is PPPoE doesn't mean the path all the way back to your ISP is a simple ethernet network. You might have a setup that is PPPoE from your router to your modem, PPPoA from the modem to the DSLAM and L2TP back to your ISP.

Thirdly PPP provides identification and authentication. This is important for a few reasons, firstly to allow robust identification of abusive users. Secondly to allow multiple ISPs to operate over the same broadband access network. Thirdly to ensure users who have purchased packages with static IPs get the correct IP.

2
  • PPPoE authentication is very weak and not followed by encryption, making it trivial to break and tamper with the traffic. Why would it be relied on for identification instead if identifying the users based on which port they use on the DSLAM? Commented Aug 14, 2016 at 19:45
  • 1
    @AndréBorie, you are confused about authentication and encryption. Authentication is just determining who you are, and it has nothing to do with the traffic. The traffic in PPP is not normally encrypted, so the traffic could be tampered with, anyway, except that PPP is a Point-to-Point Protocol, so there are only two endpoints. DHCP, on the other hand, does nothing for authentication or encryption.
    – Ron Maupin
    Commented Aug 16, 2016 at 18:12
10

Yes, the "E" in PPPoE stands for ethernet. The PPP stands for Point-to-Point Protocol. PPPoE and PPPoA are often used with DSL. PPP was the original protocol which was allowed by the DSL Forum.

PPP provides more options and security for the ISP than does DHCP. For instance, DHCP offers no authentication, but that is built into of PPP. Juniper has a whitepaper about Understanding PPPoE and DHCP:

The DSL Forum now also allows using IP over Ethernet (IPoE), which is based on DHCP. However, PPP remains the more mature and robust method for providing many broadband services.

3

As other answer, DHCP doesn't provide authentication. Any user can set static IP for his device. With PPPoE (and family), only authorized users can access the network.

1

In the early days of so-called "home networks" in Russia, the ISP used Ethernet to build their infrastructure and installed unmanaged switches in the apartment blocks due to its drastically lower cost compared to managed switch. With such setup, ISP could serve many customers for cheap, but could not reliably charge for the internet traffic or block the access, as there was no user authentication, no MAC protection, and no protection against manual changing of IP address (hijacking). Anyone could use the IP address of a paying customer on that switch (and sometimes even on other switches, depending on configuration and switch chaining) and use the internet for free.

To solve this issue, ISP used any kind of a tunnel providing authentication and sometimes encryption. Some ISP used PPPoE, the others used PPTP or L2TP. With such setup, you can make reliable traffic counters and disconnect the client any time in a centralized manner.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.