Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 6 down vote favorite

for debugging why my router wasn't connecting to pppoe i've tried to connect via the pc, it worked, then i started wireshark just to see what was going on, and i've seen that i can read all the PADI packets from ISP's other clients, now i'm thinking, is that a security problem? Can another user respond with a PADO packet and complete a pppoe session acting as gateway and maybe also sniffing pppoe credentials?

share|improve this question

1 Answer

up vote 1 down vote

I remember an Article on the German news site heise.de which described a similar vulnerability at a German DSL provider:

The problem in that case was, that not only all the PPPoE packets were visible, but all packets. So if connected directly to a Windows computer, Windows would autoconfigure a private ip-address in the 169.0.0.0/8 range. Furthermore since this is another interface, Firewall rules for the internet-connection were not applied, exposing the Windows Network file and printer sharing.

So this is the next thing to check.

share|improve this answer
I've just tried to run a pppoe-server and got full padi, pado, padr, pads handshake, ending with a padt due "RP-PPPoE: Child pppd process terminated" maybe because the server isn't configured for authentication or other things. Usually i can just see padi, just because they're in broadcast, but i can still send packets with the correct mac to another client. Btw i'm using a kind of wimax connection, not a normal dsl service. – Alessandro Jul 13 '11 at 23:18
You think that's a security problem? – Alessandro Jul 13 '11 at 23:20
Btw, i cannot directly connect to others pc because i just know the mac and not the ip (due the padi broadcast) so i can just send low level packets – Alessandro Jul 13 '11 at 23:27

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.