On Fri, Apr 24, 2020 at 03:47:34PM +0200, David Balažic wrote: > On Thu, 23 Apr 2020 at 21:36, David Balažic <xerces9@xxxxxxxxx> wrote: > > > > OK, more data: > > I started tcpdump with the -e option as suggested on openwrt forum: > > tcpdump -e -v -i eth1.3902 pppoed > > > > on disconnect, this was logged (times are UTC): > > > > > > tcpdump: listening on eth1.3902, link-type EN10MB (Ethernet), capture > > size 262144 bytes > > 18:23:09.204991 a4:7b:2c:9e:c7:44 (oui Unknown) > 44:4e:6d:fd:c7:39 > > (oui Unknown), ethertype PPPoE D (0x8863), length 97: PPPoE PADO > > [Service-Name] [AC-Name "SIMB_TABOR_BNG1"] [Host-Uniq > > 0x44************long_number******************************AA] > > [AC-Cookie ".5b************v"] > > Isnt this strange? The dst addr is not my router or any other known. > Also the Host-Uniq value is different. > As if is traffic meant for someone else. > You're probably not supposed to receive this frame, but a PADO shouldn't disconnect you. If that was a PADT, then yes, it'd be a good suspect.
