How can someone on the same GPON splitter network sniff my internet traffic?

Question

I currently have a fiber optic internet connection at home. My ISP uses GPON where the ONU acts as a gateway device which has a direct fiber optic connection to it. ONU is a Huawei HG8145V5.

I understand that downstream network traffic in a GPON splitter network is broadcast to all ONUs simultaneously,and each ONU does the filtering for the GEM packets relevant to the specific ONU and discards the rest. Hence, I have three parts to the question:

1. how is this filtering done?
2. can the downstream traffic to all ONUs be sniffed from a specific ONU connected to the same splitter network?
3. Some ISPs encrypt the downstream traffic. In that case, what information would a potential attacker/sniffer see? I.e. Would they be able to see my router's public IP or MAC address for instance? Lastly, with the information obtained from the above, would it be sufficient to locate my router/devices on the network to launch an attack?

I'm trying to secure my network, and have been seeing multiple attempts to breach my network. And frequently see that there have been configuration changes made to my router (which I have not made, checked with ISP and they have not made any changes either).

Appreciate any insights to this, particularly for means to hide my IP address from neighbouring ONUs connected to the same splitter network.

Answer 1

I'll be using the terms ONT (Optical Network Terminal) to refer to your CPE (Customer-premises equipment) ONU, and OLT (Optical Line Terminal) to refer to the network provider's termination point, where the path forward to your ISP begins.

---

To directly address your questions:

1. Simple frame discard. Think of it like a hub network where a device only cares about packets destined for it.
2. Specifically other ONTs connected to the same OLT port. Up to 128 ONTs. Depending on where you live, this is more likely 2-6 in low population areas, 10-15 in mid.
3. Nothing. As GPON operates on an ATM level, ethernet frames (and thus IP packet traffic) are completely encapsulated.

---

By design, a GPON has a reasonable level of safety and security. Most network providers mandate AES-128 or higher.

Assuming this was broken/missing, and someone on the very same OLT port as you was a bad actor, they would have access to your downstream ATM traffic (upstream would be discrete)

Depending on your ISP, this traffic may be encapulated further (either via PPPoE, or EAP over IPoE). Assuming this was broken/missing, they might have access to packet data, assuming knowledge to break down to this level.

This is no different to the multiple attack vectors that exist on the open internet. You need to assume that all traffic leaving your CPE, thought the OLT heading towards your ISP and the Internet are potentially open to sniffing, and utilise encryption where desired (HTTPS, VPN, etc.)

Your router is your first line of defense. It is more likely you are falling victim to an attack from the open internet than one from a neighour connected to the same OLT port as you. Firewall port security, traffic filtering, etc. are all important protections against an open internet.