PPPoE · Topic 1 of 4
PPPoE Theory and Comparison
Learn how PPPoE carries PPP over Ethernet, how the discovery stage finds a server, why the MTU is smaller, and how PPPoE compares with PPTP and L2TP.
- 4 min
- Includes a diagram
- PPPoE runs PPP over Ethernet and works at Layer 2.
- The client and server must be on the same broadcast domain.
- Discovery uses PADI, PADO, PADR and PADS, and PADT ends the session.
What it is
PPPoE carries PPP sessions directly over Ethernet, without an IP network underneath.
Internet providers use it to give each subscriber a login, an address and accounting on a shared Layer 2 network. The subscriber router is the client, and the provider router is the server, which is often called the access concentrator.
Because PPPoE works at Layer 2, the client and server must be on the same broadcast domain.
How it works
A client first discovers a server, and then a normal PPP session runs on top of the Ethernet link.
Discovery stage
The client finds a server with four steps, and a fifth step ends the session.
| Step | Sent by | Purpose |
|---|---|---|
| PADI | Client | Broadcast to find any server |
| PADO | Server | Offer from a server that can serve the client |
| PADR | Client | Request to the chosen server |
| PADS | Server | Confirms and assigns a session ID |
| PADT | Either end | Ends the session |
PADI is a broadcast, which is why the client and server must share a Layer 2 segment. After PADS, both ends know the session ID and the MAC addresses, and the PPP session starts.
Session stage
The session stage uses PPP. The link goes through authentication, and then addresses are assigned by the profile and secret on the server. These are the same objects used for PPTP and L2TP.
Discovery and session frames use different Ethernet types, so the two stages are separate on the wire.
Service name and access concentrator name
A server advertises a service name, and it also has an access concentrator name. A client can set either value to choose one server among several on the same segment.
If the client leaves them empty, it accepts any server that answers. On RouterOS the access concentrator name of a server is taken from the router identity.
MTU
PPPoE adds 8 bytes to every frame: 6 for the PPPoE header and 2 for the PPP protocol field. An Ethernet link carries 1500 bytes of payload, so the PPPoE interface MTU is at most 1492.
A host behind the link that sends full sized packets can hit a problem. The change-tcp-mss setting in the PPP profile lowers the TCP segment size to fit.
Comparison with PPTP and L2TP
| Feature | PPPoE | PPTP and L2TP |
|---|---|---|
| Layer | Layer 2 over Ethernet | IP tunnel across a routed network |
| Server discovery | Broadcast discovery | Client is told the server address |
| Needs same segment | Yes | No |
| Typical use | Subscriber access | Remote access across the internet |
| Built in encryption | None by itself | MPPE for PPTP, IPsec for L2TP |
| MTU overhead | 8 bytes | More, because of the IP wrapper |
PPPoE gives per subscriber control and accounting, but it does not cross routers.
Where RouterOS uses it
/interface pppoe-client print
/interface pppoe-server server print
/ppp active printThe client and server have their own menus, shown in the next two pages. They share the PPP profile, secret and pool objects with the other services.
Why providers choose PPPoE
The provider gets a login for each subscriber, accounting records, and the freedom to hand out addresses from a pool. The subscriber gets a simple setup that needs only a name and a password.
What to remember for the exam
Seven facts cover most PPPoE theory questions.
- PPPoE runs PPP over Ethernet and works at Layer 2.
- The client and server must be on the same broadcast domain.
- Discovery uses PADI, PADO, PADR and PADS, and PADT ends the session.
- PADI is a broadcast sent by the client.
- PPPoE adds 8 bytes, so the maximum MTU is 1492.
- A service name or access concentrator name lets a client pick a server.
- Authentication, addresses and rate limits come from the PPP profile and secret.
To remember the discovery order, think initiation, offer, request, session confirmation.
Common mistakes
These four errors appear again and again.
Trying to run PPPoE across a router. The discovery broadcast does not cross a routed hop, so the client never finds the server.
Forgetting the MTU. Large packets are dropped or fragmented because the link carries 1492 bytes at most.
Mixing up PADO and PADS. PADO is the offer, and PADS is the confirmation that assigns the session.
Expecting PPPoE to encrypt. It does not. Encryption needs MPPE through the profile or a separate protection layer.
A client that sets a service name that no server advertises gets no answer, even when the cable and credentials are right.
Check yourself
Work through these three questions.
Why must a PPPoE client and server share a Layer 2 segment?
Discovery starts with a PADI broadcast, which does not cross a router.
What is the maximum MTU of a PPPoE interface on Ethernet, and why?
It is 1492, because PPPoE adds 8 bytes to a 1500 byte Ethernet payload.
Which discovery message confirms the session and assigns the session ID?
PADS, sent by the server after the client sends PADR.
Topic 1 of 4 in PPPoE
Test yourself on PPPoE
The full MikroTik MTCUME question bank has 482 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by MikroTik. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.