I currently have a fiber optic internet connection at home. My ISP uses GPON where the ONU acts as a gateway device which has a direct fiber optic connection to it. ONU is a Huawei HG8145V5.

I understand that downstream network traffic in a GPON splitter network is broadcast to all ONUs simultaneously,and each ONU does the filtering for the GEM packets relevant to the specific ONU and discards the rest. Hence, I have three parts to the question:

  1. how is this filtering done?
  2. can the downstream traffic to all ONUs be sniffed from a specific ONU connected to the same splitter network?
  3. Some ISPs encrypt the downstream traffic. In that case, what information would a potential attacker/sniffer see? I.e. Would they be able to see my router's public IP or MAC address for instance? Lastly, with the information obtained from the above, would it be sufficient to locate my router/devices on the network to launch an attack?

I'm trying to secure my network, and have been seeing multiple attempts to breach my network. And frequently see that there have been configuration changes made to my router (which I have not made, checked with ISP and they have not made any changes either).

Appreciate any insights to this, particularly for means to hide my IP address from neighbouring ONUs connected to the same splitter network.

  • 1
    "have been seeing multiple attempts to breach my network" all networks attached to the internet are constantly undergoing some sort of probing. Do you really believe you are dealing with anything more targeted? Sep 26, 2021 at 4:36
  • That's right, I do believe so. In this case, a unique class of attack is possible where a neighbouring ONU connected to the same splitter would be able to determine my IP address by sniffing downstream network traffic which subsequently allows them to launch any further attacks. Sep 26, 2021 at 9:35
  • 1
    how are you logging/detecting such attacks? Configuration changes could happen for a number of reasons. Sep 26, 2021 at 17:25
  • Telnet automatically turning on on my router is not something that happens randomly, especially since my ISP has already told me this is something that is disabled by default and I have never enabled it on my own. However, despite resetting the router several times and even replacing it with a new router, after a few days telnet will be reenabled again. This is one of the ways the attacker is getting access to my network. And due to the nature of GPON implementation, it's hard to mask the public IP address from my neighbouring ONUs. Sep 26, 2021 at 18:11
  • 3
    It's really hard to say without a deep dive into your entire network/all devices, which is likely out of scope here. Unfortunately, I know nothing about GPON or ONU. But if your router can have telnet trivially enabled, I would say you should pick a different model to begin with. Sep 26, 2021 at 20:18

1 Answer 1


I'll be using the terms ONT (Optical Network Terminal) to refer to your CPE (Customer-premises equipment) ONU, and OLT (Optical Line Terminal) to refer to the network provider's termination point, where the path forward to your ISP begins.

To directly address your questions:

  1. Simple frame discard. Think of it like a hub network where a device only cares about packets destined for it.
  2. Specifically other ONTs connected to the same OLT port. Up to 128 ONTs. Depending on where you live, this is more likely 2-6 in low population areas, 10-15 in mid.
  3. Nothing. As GPON operates on an ATM level, ethernet frames (and thus IP packet traffic) are completely encapsulated.

By design, a GPON has a reasonable level of safety and security. Most network providers mandate AES-128 or higher.

Assuming this was broken/missing, and someone on the very same OLT port as you was a bad actor, they would have access to your downstream ATM traffic (upstream would be discrete)

Depending on your ISP, this traffic may be encapulated further (either via PPPoE, or EAP over IPoE). Assuming this was broken/missing, they might have access to packet data, assuming knowledge to break down to this level.

This is no different to the multiple attack vectors that exist on the open internet. You need to assume that all traffic leaving your CPE, thought the OLT heading towards your ISP and the Internet are potentially open to sniffing, and utilise encryption where desired (HTTPS, VPN, etc.)

Your router is your first line of defense. It is more likely you are falling victim to an attack from the open internet than one from a neighour connected to the same OLT port as you. Firewall port security, traffic filtering, etc. are all important protections against an open internet.

  • 1
    Thank you for the detailed answer, exactly what I wanted. In this case, as long as my ONT has no known vulnerabilities or misconfigs, then the downstream data will not contain any identifiable information, correct? In this case, if my PPPoE credentials are known, and the attacker is using a modified ONU then they'd be able to access packet data? The reason why I suspect this might be the case is that this has been very persistent when I'm using a VPN and only check my mail and visit mainstream news sites. Sep 28, 2021 at 19:34
  • Additionally, how likely it is for someone to sniff the traffic and gain the encryption keys in this GPON setup we're discussing? Assuming the attacker is persistent enough and is willing the tap the upstream fiber to the OLT when the router is restarted (since the fiber cables are exposed where I live) and upstream traffic is sent in plaintext. A paper briefly talked about this here in Section 5 - intechopen.com/chapters/64939. Keen to get your thoughts on this. Sep 28, 2021 at 19:45

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .