I am really confused about tunneling protocol family and all related protocols. I read a bunch of articles, rfc but still cannot get the idea.

I will put my questions between my explanation.

A little bit about my network configuration.
1. I have home router (wifi), it is connected to my ISP via PPPoE.
2. All packets were captured while I was connected to the remote VPN server over PPTP protocol.

In computer networking, Point-to-Point Protocol (PPP) is a data link (layer 2) protocol used to establish a direct connection between two nodes.
Q-1: What does point to point in general mean ? How can I connect not point to point ? I have only one cable, in case of my network, my router is connected to the switch with the cable ?

I have captured packets, here is wireshark information about the PPP packet. https://i.sstatic.net/hYI3T.jpg

Q-2: Point-to-Point Protocol (PPP) is a data link Hmm. Why then this packet is encapsulated inside IP -> GRE ???? It is not second layer

Q-3: How PPP (PPPoe) differs from simple Data Link ethernet frame (used by switches) ?

Also VPN connection is called PPTP, so as I could guess PPTP is used just for session establishment, nothing else. Because I can see PPTP packets only serveral times while communication.

Captured packet https://i.sstatic.net/XBFQt.jpg

And this goes even further above Layer 4 (TCP).

So I am really confused about all these stuff, so I try to explain how I understand a process is general.

First of all PPP is just standard for special packet format on the data link layer, it is used because this protocol (PPP) is implemented above different physical environments like Ethernet, ATM...

Why is it used ? Because it provides auth on the second layer of OSI using LCP, NCP protocols. So basically when I am connecting to my provider I use credentials to establish the connection.

Sometimes encapsulation is mentioned as an advantage of this protocol

Q-4: Why this is an advantage ? OSI stack assumes encapsulation out of the box, each higher layers is just encapsulated inside payload field of the the lower one !!

So basically PPP allows authentication and compression.

When I am using VPN (PPTP) as far as PPTP server is specific application that uses port (1723) in order to listen inbound connections.Thats why it is located above TCP. And this protocol is just used to establish communication with the server.

Q-5: How does further communication work if PPP packets are just wrapped in IP and no port is specified ? How does VPN server machine know that this packet is tunnel and it should be redirected to the 1723 port application in order to proceed ?

Please help me to understand this topic, please answer my questions. I would be grateful for any help

1 Answer 1


Your question is really too broad, and home networking and consumer-grade devices are explicitly off-topic here, but I will try to give you some general answers.

  1. PPP is a layer-2 protocol, the same way that ethernet, HDLC, frame relay, ATM, etc. are. PPP is specifically a point-to-point protocol with only two endpoints. Other protocols, e.g. ethernet, are designed to work with multiple possible endpoints. Because ethernet, and other IEEE LAN protocols can have multiple connection, they use MAC addresses, but PPP doesn't.
  2. I don't really understand your second question. PPP is a layer-2 protocol, but IP is a layer-3 protocol. In general, layer-2 protocols don't care about layer-3, and they can carry any number of layer-3 protocols.
  3. Ethernet is both a layer-1 and a layer-2 protocol. PPPoE uses PPP for the layer-2 protocol on an ethernet layer-1. The PPP frames are encapsulated in ethernet frames. As far as your traffic is concerned, it is passing through an interface that uses PPP as the layer-2 protocol. PPP can be used on multiple different layer-1 interfaces, e.g. serial, ATM, etc. PPP adds some feature that allow you to negotiate layer-3 addressing, data compression, authentication, etc. that do not exist in other layer-2 protocols.
  4. Your fourth question doesn't really make much sense. You seem to be comparing apples to oranges. PPP is a layer-2 protocol, but PPTP basically allows you to extend a LAN on top of other protocols. As you wrote, it is above layer-4, and the layer-2 protocol used when using PPTP could be PPP. Unfortunately protocols above layer-4 are explicitly off-topic here.
  5. PPP frames are not wrapped in IP packets. It is the other way around; IP packets can be wrapped in PPP (or other layer-2 protocol) frames. Neither layer-2 nor layer-3 know anything about ports, which are layer-4 addresses for some layer-4 protocols. Routers strip off layer-2 frames from the layer-3 packets, so the router on the other end of the PPP link will strip off the PPP frame. A router will then route the layer-3 packet, and it will create a new frame for the new interface for the packet. By the time the packet gets to a server, the PPP frame will be long gone. The server will have a network stack through which the frame it receives passes. When it gets to TCP at layer-4, then it will have the port used, and it will know to which process in the server it should send the TCP segment.
  • Thank you for answer, appreciate your help, I have found interesting article, I think it somehow is related to my question. think-like-a-computer.com/2011/07/28/pptp-passthrough So if VPN connection is established with the help of the PPTP server listening on the 1723 port, so it this server has to control communication, but after PPTP session establishment, all packets are just IPs, contain GRE-> PPP packets. We have the IP to get to the server, but how does the server (OS) know where to direct incoming packet without port being specified ?
    – brqgddez
    Commented Jan 16, 2017 at 18:48
  • But the port is specified. It is on the TCP segment. A port (layer-4 address for TCP or UDP) is a field in the layer-4 header. Layer-3 headers have layer-3 addresses, and layer-2 headers have layer-2 addresses. It is the same way for an HTTP client connecting to an HTTP server. The layer-2 and layer-3 protocols don't know or care anything about the layer-4 protocol or port. The network stack in the server gets to the layer-4 protocol, and the port on the layer-4 header tells the server which process in the server gets the layer-4 payload.
    – Ron Maupin
    Commented Jan 16, 2017 at 18:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.