PPPoE报文帧格式

PPPoE是对PPP的扩展，提供了在以太网上建立PPPoE会话以及封装PPP数据帧的方法。

一、PPPoE报文帧格式

+-----------+-----------+-------------+--------------------+-----------

+-----------+-----------+-------------+--------------------+-----------

| |

+----------+----------+--------+------------+----------+---------------

+----------+----------+--------+------------+----------+---------------

二、PPPoE报文帧中字段解释

字段	长度	含义
DMAC	6字节	以太网单播目的地址或者以太网广播地址（0xFFFFFFFF）。在Discovery数据包中，该域的值是以太网广播地址；在PPPoE会话阶段中，该域必须是Discovery阶段已经确定的通信对方的单播地址。
SMAC	6字节	发送该数据帧的源设备的MAC地址。
Type/Length	2字节	该字段有两种含义： · Length：如果该字段值小于或等于二进制1500（或十六进制0x05DC）时，该字段指后续数据的字节长度，但不包括FCS字段。 · Type：如果该字段值大于或等于二进制1536（或十六进制0x0600）时，该字段指链路直接封装的上层协议类型。对于PPPoE报文，该字段只表示Type：当值为0x8863时表示Discovery阶段；当值为0x8864时表示PPPoE会话阶段。
Payload Data	可变	以太帧的数据字段。
FCS	4字节	帧校验序列FCS（Frame Check Sequence）是为接收网卡提供判断是否传输错误的一种方法，如果发现错误，丢弃此帧。 FCS只是通用叫法，具体的FCS还可以细分多种校验方法。在以太帧中，FCS通常采用循环冗余码校验CRC（Cyclical Redundancy Check）。
Ver	4比特	PPPoE版本，必须设置为0x01。
Type	4比特	PPPoE类型，必须设置为0x01。
Code	1字节	其定义在后面的Discovery和PPPoE会话中分别指定，即类型不同的PPPoE报文对应不同的Code值。
Session ID	2字节	是一个按网络字节顺序（即，将低位字节排在前）的无符号值。其值在后面Discovery数据包中定义。对一个给定的PPPoE会话来说该值是一个固定值，并且与以太网DMAC和SMAC一起实际地定义了一个PPPoE会话。值0xFFFF保留给将来使用，当前不允许使用。
Length	2字节	该值是PPPoE的Payload长度。它不包括以太网头部和PPPoE头部的长度。
Payload Data1	可变	PPPOE协议共包括两个阶段，即PPPOE的发现阶段（PPPOE Discovery Stage）和PPPOE的会话阶段（PPPOE Session Stage）。在PPPOE的会话阶段，Payload Data域携带的是PPP的报文；而在PPPOE的发现阶段时，Payload Data域内则会填充一些Tag（标记）。一个Tag是一个TLV（Type-Length-Value）结构，其格式如下： +------------------------+ \| Tag_Type (2 bytes) \| +------------------------+ \| Tag_Length (2 bytes) \| +------------------------+ \| Tag_value (variable) \| +------------------------+ · Tag_type：2字节，网络字节序。后面表中列出了各种Tag_Type值对应的含义。 · Tag_Length：2字节，是一个网络字节序的无符号值，表明Tag_Value的字节数。如果收到的Discovery数据包中包含未知的Tag_Type，则必须忽略掉该Tag。 · Tag_value：可变长度，Tag的数据字段。

三、PPPoE报文帧Tag_Type值

Value	Tag_Type	含义
0x0000	End-Of-List	该Tag值表明是最后一个Tag。该Tag的Tag_Length必须总是0。不要求使用该标签，它是为了向后兼容，在有些报文中有应用。
0x0101	Service-Name	该Tag表明后面紧跟的是服务的名称，主要用来表明网络侧所能提供给用户的服务。 · Tag_Value是不以NULL结束的字符串。 · 当Tag_Length为0时，该TAG用于表明接受任何服务。使用Service-Name标签的例子是表明Internet服务提供商ISP或者一类服务或者服务的质量。
0x0102	AC-Name	该Tag表明后面紧跟的字符串唯一地表示了某个特定的接入服务器。它可以是商标、型号以及序列号等信息的集合，或者该接入服务器MAC地址的一个简单表示。它不以NULL来结束。
0x0103	Host-Uniq	该Tag由主机用于把接入服务器的响应报文（PADO或者PADS）与主机的某个唯一特定的请求联系起来。Tag_Value是主机选择的长度和值，可以是任意的二进制数据。它不能由接入服务器解释。主机可以在PADI或者PADR中包含一个Host-Uniq标签。如果接入服务器收到了该标签，它必须在对应的PADO或者PADS中不加改变的包含该标签。
0x0104	AC-Cookie	该Tag由接入服务器用于防止服务攻击。接入服务器可以在PADO数据包中包含该Tag。如果主机收到了该标签，它必须在接下来的PADR中不加改变的包含该标签。 Tag_Value的长度和值都是任意的二进制数据。
0x0105	Vendor-Specific	该Tag用来传送厂商自定义的信息。Tag_Value的前4个字节包含了厂商的识别码，其余字节尚未定义。厂商识别码的高字节为0，低3个字节为网络字节序的厂商的SMI网络管理专用企业码。不推荐使用该Tag。为了确保互操作性，在实现过程中，可以忽略Vendor-Specific Tag。
0x0110	Relay-Session-Id	中继会话ID，对于PPPOE的数据报文也同样可以像DHCP报文一样被中断到另外的AC上终结，这个字段则是用来维护另一个连接的。可由中继流量的中间代理加入到Discovery数据包中。所有的PADI数据包必须保证足够空间来加入Tag_Value长度为12字节的Relay-Session-Id标签。如果Discovery数据包中已经包含一个Relay-Session-Id标签，则不允许再加入该标签。这种情况下，中间代理应该使用该Relay-Session-Id标签。如果它不能使用现有的标签，或者没有足够空间来增加一个Relay-Session-Id标签，那么它应该向发送者返回一个Generic-Error标签。
0x0201	Service-Name-Error	服务名错误，当请求的服务名不被对端所接受时，会在响应的报文中携带这个标记。它表明了由于某种原因，没有理睬所请求的Service-Name。如果有数据部分，并且数据部分的头一个字节非0，那么它必须是一个可打印字符串，解释请求被拒绝的原因。该字符串可以不以NULL结束。
0x0202	AC-System-Error	该Tag表明了接入服务器在处理主机请求时出现了某个错误。例如没有足够资源来创建一个虚拟电路。PADS数据包中可以包含该标签。如果有数据，并且数据的第一个字节不为0，那么数据必须是一个可打印字符串，该字符串解释了错误的性质。该字符串可以不以NULL结束。
0x0203	Generic-Error	该Tag表明发生了一般性错误。当发生一个不可恢复的错误并且没有其它合适的Tag时，它可被加到PADO、PADR或PADS数据包中。如果出现数据部分，那么数据必须是一个解释错误性质的字符串。该字符串不允许以NULL结束。

四、PPPoE报文帧示例

4.1、 PPPoE帧（发现阶段的PADI帧）

Frame 1: 24 bytes on wire (192 bits), 24 bytes captured (192 bits)

Arrival Time: Jul 28, 2015 01:24:27.745022000

Epoch Time: 1438017867.745022000 seconds

[Time delta from previous captured frame: 0.000000000 seconds]

[Time delta from previous displayed frame: 0.000000000 seconds]

[Time since reference or first frame: 0.000000000 seconds]

Frame Number: 1

Frame Length: 24 bytes (192 bits)

Capture Length: 24 bytes (192 bits)

[Frame is marked: False]

[Frame is ignored: False]

[Protocols in frame: eth:pppoed]

[Coloring Rule Name: Broadcast]

[Coloring Rule String: eth[0] & 1]

Ethernet II, Src: 20:28:18:a0:a9:d2 (20:28:18:a0:a9:d2), Dst: Broadcast (ff:ff:ff:ff:ff:ff)

Destination: Broadcast (ff:ff:ff:ff:ff:ff)

Address: Broadcast (ff:ff:ff:ff:ff:ff)

.... ...1 .... .... .... .... = IG bit: Group address (multicast/broadcast)

.... ..1. .... .... .... .... = LG bit: Locally administered address (this is NOT the factory default)

Source: 20:28:18:a0:a9:d2 (20:28:18:a0:a9:d2)

Address: 20:28:18:a0:a9:d2 (20:28:18:a0:a9:d2)

.... ...0 .... .... .... .... = IG bit: Individual address (unicast)

.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)

Type: PPPoE Discovery (0x8863)

PPP-over-Ethernet Discovery

0001 .... = Version: 1

.... 0001 = Type: 1

Code: Active Discovery Initiation (PADI) (0x09)

Session ID: 0x0000

Payload Length: 4

PPPoE Tags

4.2、PPPoE帧（发现阶段的PADO帧）

Frame 2: 60 bytes on wire (480 bits), 60 bytes captured (480 bits)

Arrival Time: Jul 28, 2015 01:24:27.769982000

Epoch Time: 1438017867.769982000 seconds

[Time delta from previous captured frame: 0.024960000 seconds]

[Time delta from previous displayed frame: 0.024960000 seconds]

[Time since reference or first frame: 0.024960000 seconds]

Frame Number: 2

Frame Length: 60 bytes (480 bits)

Capture Length: 60 bytes (480 bits)

[Frame is marked: False]

[Frame is ignored: False]

[Protocols in frame: eth:pppoed]

Ethernet II, Src: Unispher_a4:10:be (00:90:1a:a4:10:be), Dst: 20:28:18:a0:a9:d2 (20:28:18:a0:a9:d2)

Destination: 20:28:18:a0:a9:d2 (20:28:18:a0:a9:d2)

Address: 20:28:18:a0:a9:d2 (20:28:18:a0:a9:d2)

.... ...0 .... .... .... .... = IG bit: Individual address (unicast)

.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)

Source: Unispher_a4:10:be (00:90:1a:a4:10:be)

Address: Unispher_a4:10:be (00:90:1a:a4:10:be)

.... ...0 .... .... .... .... = IG bit: Individual address (unicast)

.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)

Type: PPPoE Discovery (0x8863)

PPP-over-Ethernet Discovery

0001 .... = Version: 1

.... 0001 = Type: 1

Code: Active Discovery Offer (PADO) (0x07)

Session ID: 0x0000

Payload Length: 35

PPPoE Tags

AC-Name: r-al121

AC-Cookie: bebcb53c10b32769a8661c36a45d8720

4.3、PPPoE帧（发现阶段的PADR帧）

Frame 3: 44 bytes on wire (352 bits), 44 bytes captured (352 bits)

Arrival Time: Jul 28, 2015 01:24:27.770082000

Epoch Time: 1438017867.770082000 seconds

[Time delta from previous captured frame: 0.000100000 seconds]

[Time delta from previous displayed frame: 0.000100000 seconds]

[Time since reference or first frame: 0.025060000 seconds]

Frame Number: 3

Frame Length: 44 bytes (352 bits)

Capture Length: 44 bytes (352 bits)

[Frame is marked: False]

[Frame is ignored: False]

[Protocols in frame: eth:pppoed]

Ethernet II, Src: 20:28:18:a0:a9:d2 (20:28:18:a0:a9:d2), Dst: Unispher_a4:10:be (00:90:1a:a4:10:be)

Destination: Unispher_a4:10:be (00:90:1a:a4:10:be)

Address: Unispher_a4:10:be (00:90:1a:a4:10:be)

.... ...0 .... .... .... .... = IG bit: Individual address (unicast)

.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)

Source: 20:28:18:a0:a9:d2 (20:28:18:a0:a9:d2)

Address: 20:28:18:a0:a9:d2 (20:28:18:a0:a9:d2)

.... ...0 .... .... .... .... = IG bit: Individual address (unicast)

.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)

Type: PPPoE Discovery (0x8863)

PPP-over-Ethernet Discovery

0001 .... = Version: 1

.... 0001 = Type: 1

Code: Active Discovery Request (PADR) (0x19)

Session ID: 0x0000

Payload Length: 24

PPPoE Tags

AC-Cookie: bebcb53c10b32769a8661c36a45d8720

4.4、 PPPoE帧（发现阶段的PADS帧）

Frame 4: 60 bytes on wire (480 bits), 60 bytes captured (480 bits)

Arrival Time: Jul 28, 2015 01:24:27.859184000

Epoch Time: 1438017867.859184000 seconds

[Time delta from previous captured frame: 0.089102000 seconds]

[Time delta from previous displayed frame: 0.089102000 seconds]

[Time since reference or first frame: 0.114162000 seconds]

Frame Number: 4

Frame Length: 60 bytes (480 bits)

Capture Length: 60 bytes (480 bits)

[Frame is marked: False]

[Frame is ignored: False]

[Protocols in frame: eth:pppoed]

Ethernet II, Src: Unispher_a4:10:be (00:90:1a:a4:10:be), Dst: 20:28:18:a0:a9:d2 (20:28:18:a0:a9:d2)

Destination: 20:28:18:a0:a9:d2 (20:28:18:a0:a9:d2)

Address: 20:28:18:a0:a9:d2 (20:28:18:a0:a9:d2)

.... ...0 .... .... .... .... = IG bit: Individual address (unicast)

.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)

Source: Unispher_a4:10:be (00:90:1a:a4:10:be)

Address: Unispher_a4:10:be (00:90:1a:a4:10:be)

.... ...0 .... .... .... .... = IG bit: Individual address (unicast)

.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)

Type: PPPoE Discovery (0x8863)

PPP-over-Ethernet Discovery

0001 .... = Version: 1

.... 0001 = Type: 1

Code: Active Discovery Session-confirmation (PADS) (0x65)

Session ID: 0x18b2

Payload Length: 4

PPPoE Tags

4.5、 PPPoE帧（会话阶段）

Frame 1: 70 bytes on wire (560 bits), 70 bytes captured (560 bits)

Arrival Time: Jan 2, 2014 16:37:54.073759000

Epoch Time: 1388651874.073759000 seconds

[Time delta from previous captured frame: 0.000000000 seconds]

[Time delta from previous displayed frame: 0.000000000 seconds]

[Time since reference or first frame: 0.000000000 seconds]

Frame Number: 1

Frame Length: 70 bytes (560 bits)

Capture Length: 70 bytes (560 bits)

[Frame is marked: False]

[Frame is ignored: False]

[Protocols in frame: eth:pppoes:ppp:ip:udp:l2tp]

[Coloring Rule Name: UDP]

[Coloring Rule String: udp]

Ethernet II, Src: Sfr_18:c2:73 (e0:a1:d7:18:c2:73), Dst: Sfr_61:00:00 (00:17:33:61:00:00)

Destination: Sfr_61:00:00 (00:17:33:61:00:00)

Address: Sfr_61:00:00 (00:17:33:61:00:00)

.... ...0 .... .... .... .... = IG bit: Individual address (unicast)

.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)

Source: Sfr_18:c2:73 (e0:a1:d7:18:c2:73)

Address: Sfr_18:c2:73 (e0:a1:d7:18:c2:73)

.... ...0 .... .... .... .... = IG bit: Individual address (unicast)

.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)

Type: PPPoE Session (0x8864)

PPP-over-Ethernet Session

0001 .... = Version: 1

.... 0001 = Type: 1

Code: Session Data (0x00)

Session ID: 0x3b1a

Payload Length: 50

Point-to-Point Protocol

Protocol: IP (0x0021)

Internet Protocol Version 4, Src: 10.136.242.99 (10.136.242.99), Dst: 10.6.1.72 (10.6.1.72)

Version: 4

Header length: 20 bytes

Differentiated Services Field: 0xb4 (DSCP 0x2d: Unknown DSCP; ECN: 0x00: Not-ECT (Not ECN-Capable Transport))

1011 01.. = Differentiated Services Codepoint: Unknown (0x2d)

.... ..00 = Explicit Congestion Notification: Not-ECT (Not ECN-Capable Transport) (0x00)

Total Length: 48

Identification: 0x0000 (0)

Flags: 0x02 (Don't Fragment)

0... .... = Reserved bit: Not set

.1.. .... = Don't fragment: Set

..0. .... = More fragments: Not set

Fragment offset: 0

Time to live: 64

Protocol: UDP (17)

Header checksum: 0x79cf [correct]

[Good: True]

[Bad: False]

Source: 10.136.242.99 (10.136.242.99)

Destination: 10.6.1.72 (10.6.1.72)

User Datagram Protocol, Src Port: l2f (1701), Dst Port: l2f (1701)

Source port: l2f (1701)

Destination port: l2f (1701)

Length: 28

Checksum: 0x0000 (none)

[Good Checksum: False]

[Bad Checksum: False]

Layer 2 Tunneling Protocol

Packet Type: Control Message Tunnel Id=1527 Session Id=0

1... .... .... .... = Type: Control Message (1)

.1.. .... .... .... = Length Bit: Length field is present

.... 1... .... .... = Sequence Bit: Ns and Nr fields are present

.... ..0. .... .... = Offset bit: Offset size field is not present

.... ...0 .... .... = Priority: No priority

.... .... .... 0010 = Version: 2

Length: 20

Tunnel ID: 1527

Session ID: 0

Ns: 15

Nr: 2

Control Message AVP

Mandatory: True

Hidden: False

Length: 8

Vendor ID: Reserved (0)

Type: Control Message (0)

Control Message Type: (6) Hello

五、PPPoE协议参考标准

RFC 2516

A Method for Transmitting PPP Over Ethernet (PPPoE)

PPPoE报文帧格式

相关文章

发表评论

热门文章

文章分类

最新评论