Using Wireshark for a DSL "link no surf" problem

[Kok-Yong Tan]

Is it possible to use Wireshark to troubleshoot a DSL "link no surf" problem? The ISP insists it's a CPE issue but the problem only started after their Tier 1 tech monkeyed with the DSLAM and/or the CPE (remotely) in some manner. I find it suspicious that the problem was intermittent packet loss until they tinkered, whereupon the problem became a "link no surf" issue (i.e., there's Layer 2 connectivity but zero Layer 3 traffic passing).
--
Reality Artisans, Inc. # Network Wrangling and Delousing
P.O. Box 565, Gracie Station # Apple Certified Consultant
New York, NY 10028-0019 # Apple Consultants Network member
<http://www.realityartisans.com> # Apple Developer Connection member
Cell: [phone] # Ofc: [phone]

___________________________________________________________________________
Sent via: Wireshark-users mailing list <wireshark-users-IZ8446WsY0/***@public.gmane.org>
Archives: http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
mailto:wireshark-users-request-IZ8446WsY0/***@public.gmane.org?subject=unsubscribe

[Jaap Keuter]

On 06/17/2014 08:42 PM, Kok-Yong Tan wrote:
> Is it possible to use Wireshark to troubleshoot a DSL "link no surf" problem? The ISP insists it's a CPE issue but the problem only started after their Tier 1 tech monkeyed with the DSLAM and/or the CPE (remotely) in some manner. I find it suspicious that the problem was intermittent packet loss until they tinkered, whereupon the problem became a "link no surf" issue (i.e., there's Layer 2 connectivity but zero Layer 3 traffic passing).
>

Depends on what you can trace in the CPE, as in, how close to the DSL interface.
Otherwise you'll need capture hardware on the DSL....

Good luck,
Jaap

___________________________________________________________________________
Sent via: Wireshark-users mailing list <wireshark-users-IZ8446WsY0/***@public.gmane.org>
Archives: http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
mailto:wireshark-users-request-IZ8446WsY0/***@public.gmane.org?subject=unsubscribe

[Kok-Yong Tan]

> On Jun 17, 2014, at 14:28, Jaap Keuter <jaap.keuter-qWit8jRvyhVmR6Xm/***@public.gmane.org> wrote:
>
>> On 06/17/2014 08:42 PM, Kok-Yong Tan wrote:
>> Is it possible to use Wireshark to troubleshoot a DSL "link no surf" problem? The ISP insists it's a CPE issue but the problem only started after their Tier 1 tech monkeyed with the DSLAM and/or the CPE (remotely) in some manner. I find it suspicious that the problem was intermittent packet loss until they tinkered, whereupon the problem became a "link no surf" issue (i.e., there's Layer 2 connectivity but zero Layer 3 traffic passing).
>
> Depends on what you can trace in the CPE, as in, how close to the DSL interface.
> Otherwise you'll need capture hardware on the DSL....
>
> Good luck,
> Jaap
>

I can get up to the DSL modem itself. In hindsight, I'm thinking this isn't going to be of much use and the only way to debug this is with capture hardware on the DSL side as you suggested. Drat.
--
Sent from my iPad2 with greater chance of typographical, grammatical and other disasters. Your indulgence is even more humbly requested.

[Pedro Tumusok]

Usually the CPE gives you some data about the physical link that can be
used to figure out what the issue is.
Are you sure there is L2 connectivity?

Pedro


On Tue, Jun 17, 2014 at 11:53 PM, Kok-Yong Tan <ktan-Utl/FKD7rXpskJ3/***@public.gmane.org>
wrote:

>
> > On Jun 17, 2014, at 14:28, Jaap Keuter <jaap.keuter-qWit8jRvyhVmR6Xm/***@public.gmane.org> wrote:
> >
> >> On 06/17/2014 08:42 PM, Kok-Yong Tan wrote:
> >> Is it possible to use Wireshark to troubleshoot a DSL "link no surf"
> problem? The ISP insists it's a CPE issue but the problem only started
> after their Tier 1 tech monkeyed with the DSLAM and/or the CPE (remotely)
> in some manner. I find it suspicious that the problem was intermittent
> packet loss until they tinkered, whereupon the problem became a "link no
> surf" issue (i.e., there's Layer 2 connectivity but zero Layer 3 traffic
> passing).
> >
> > Depends on what you can trace in the CPE, as in, how close to the DSL
> interface.
> > Otherwise you'll need capture hardware on the DSL....
> >
> > Good luck,
> > Jaap
> >
>
> I can get up to the DSL modem itself. In hindsight, I'm thinking this
> isn't going to be of much use and the only way to debug this is with
> capture hardware on the DSL side as you suggested. Drat.
> --
> Sent from my iPad2 with greater chance of typographical, grammatical and
> other disasters. Your indulgence is even more humbly requested.
> ___________________________________________________________________________
> Sent via: Wireshark-users mailing list <wireshark-users-IZ8446WsY0/***@public.gmane.org>
> Archives: http://www.wireshark.org/lists/wireshark-users
> Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
> mailto:wireshark-users-request-IZ8446WsY0/***@public.gmane.org
> ?subject=unsubscribe
>



--
Best regards / Mvh
Jan Pedro Tumusok

[Kok-Yong Tan]

According to a more helpful member of the ISP's tech support staff, he tells me that he *CAN* see the layer 2 link from his end. Just that there's no layer 3 traffic flowing across it, just the occasional layer 2 "keep alive" pulses.

Also, I can connect directly into the DSL modem. With reference to this user manual for my DSL modem

<http://innoband.com/documents/8012_V1_Manual.pdf>

I have solid green lights for the Power, LAN and DSL LEDs but a totally dark Internet LED (which I think mirrors exactly what the helpful tech support rep is saying). In the diagnostic page of the DSL modem, it says that "ATM OAM segment ping" and "ATM OAM end to end ping" fails. Also, PPPoE server session and authentication to server fails.

I have screenshots of the various webpages on the DSL modem with more info if it's of any help (I don't know if it can be posted on this mailing list--some mailing lists prohibit attachments).
--
Reality Artisans, Inc. # Network Wrangling and Delousing
P.O. Box 565, Gracie Station # Apple Certified Consultant
New York, NY 10028-0019 # Apple Consultants Network member
<http://www.realityartisans.com> # Apple Developer Connection member
Cell: [phone] # Ofc: [phone]

On Jun 17, 2014, at 16:31 , Pedro Tumusok <pedro.tumusok-***@public.gmane.org> wrote:

> Usually the CPE gives you some data about the physical link that can be used to figure out what the issue is.
> Are you sure there is L2 connectivity?
>
> Pedro
>
>
> On Tue, Jun 17, 2014 at 11:53 PM, Kok-Yong Tan <ktan-Utl/FKD7rXpskJ3/***@public.gmane.org> wrote:
>
> > On Jun 17, 2014, at 14:28, Jaap Keuter <jaap.keuter-qWit8jRvyhVmR6Xm/***@public.gmane.org> wrote:
> >
> >> On 06/17/2014 08:42 PM, Kok-Yong Tan wrote:
> >> Is it possible to use Wireshark to troubleshoot a DSL "link no surf" problem? The ISP insists it's a CPE issue but the problem only started after their Tier 1 tech monkeyed with the DSLAM and/or the CPE (remotely) in some manner. I find it suspicious that the problem was intermittent packet loss until they tinkered, whereupon the problem became a "link no surf" issue (i.e., there's Layer 2 connectivity but zero Layer 3 traffic passing).
> >
> > Depends on what you can trace in the CPE, as in, how close to the DSL interface.
> > Otherwise you'll need capture hardware on the DSL....
> >
> > Good luck,
> > Jaap
> >
>
> I can get up to the DSL modem itself. In hindsight, I'm thinking this isn't going to be of much use and the only way to debug this is with capture hardware on the DSL side as you suggested. Drat.
> --
> Sent from my iPad2 with greater chance of typographical, grammatical and other disasters. Your indulgence is even more humbly requested.
> ___________________________________________________________________________
> Sent via: Wireshark-users mailing list <wireshark-users-IZ8446WsY0/***@public.gmane.org>
> Archives: http://www.wireshark.org/lists/wireshark-users
> Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
> mailto:wireshark-users-request-IZ8446WsY0/***@public.gmane.org?subject=unsubscribe
>
>
>
> --
> Best regards / Mvh
> Jan Pedro Tumusok
>
> ___________________________________________________________________________
> Sent via: Wireshark-users mailing list <wireshark-users-IZ8446WsY0/***@public.gmane.org>
> Archives: http://www.wireshark.org/lists/wireshark-users
> Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
> mailto:wireshark-users-request-IZ8446WsY0/***@public.gmane.org?subject=unsubscribe

[Guy Harris]

On Jun 17, 2014, at 7:10 PM, Kok-Yong Tan <ktan-Utl/FKD7rXpskJ3/***@public.gmane.org> wrote:

> In the diagnostic page of the DSL modem, it says that "ATM OAM segment ping" and "ATM OAM end to end ping" fails.

DISCLAIMER: I'm not an expert on this stuff beyond some knowledge of ATM and the way stuff gets transported over it.

I'm not sure what "layer 2" and "layer 3" mean in this context, but that error sounds as if it's way below the PPP-over-ATM or PPP-over-bridged-Ethernet-over-ATM or whatever sort of IP-layer stuff is supposed to go over the wire - that sounds like a problem with the ATM link.
___________________________________________________________________________
Sent via: Wireshark-users mailing list <wireshark-users-IZ8446WsY0/***@public.gmane.org>
Archives: http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
mailto:wireshark-users-request-IZ8446WsY0/***@public.gmane.org?subject=unsubscribe

[Jamie O. Montgomery]

I work with DSL at work, so I'd be interested in seeing your screen captures to see if I can help.

Jamie Montgomery | Comporium
Network Facilities Engineering | Engineering Associate II


The information contained in this e-mail message and any attachments thereto are confidential, privileged, or otherwise protected from disclosure, and are intended for the use of the individual or entity named above. Dissemination, distribution or copying of this message and any attachments by anyone other than the intended recipient, or an employee or agent responsible for delivering the message to the intended recipient, is prohibited. If you have received this communication in error, please immediately notify the sender by telephone or e-mail and destroy the original message, attachments, and all copies.

On Jun 17, 2014 10:18 PM, Kok-Yong Tan <ktan-Utl/FKD7rXpskJ3/***@public.gmane.org> wrote:
According to a more helpful member of the ISP's tech support staff, he tells me that he *CAN* see the layer 2 link from his end. Just that there's no layer 3 traffic flowing across it, just the occasional layer 2 "keep alive" pulses.

Also, I can connect directly into the DSL modem. With reference to this user manual for my DSL modem

<http://innoband.com/documents/8012_V1_Manual.pdf>

I have solid green lights for the Power, LAN and DSL LEDs but a totally dark Internet LED (which I think mirrors exactly what the helpful tech support rep is saying). In the diagnostic page of the DSL modem, it says that "ATM OAM segment ping" and "ATM OAM end to end ping" fails. Also, PPPoE server session and authentication to server fails.

I have screenshots of the various webpages on the DSL modem with more info if it's of any help (I don't know if it can be posted on this mailing list--some mailing lists prohibit attachments).
--
Reality Artisans, Inc. # Network Wrangling and Delousing
P.O. Box 565, Gracie Station # Apple Certified Consultant
New York, NY 10028-0019 # Apple Consultants Network member
<http://www.realityartisans.com<http://www.realityartisans.com/>> # Apple Developer Connection member
Cell: [phone] # Ofc: [phone]

On Jun 17, 2014, at 16:31 , Pedro Tumusok <pedro.tumusok-***@public.gmane.org<mailto:pedro.tumusok-***@public.gmane.org>> wrote:

Usually the CPE gives you some data about the physical link that can be used to figure out what the issue is.
Are you sure there is L2 connectivity?

Pedro


On Tue, Jun 17, 2014 at 11:53 PM, Kok-Yong Tan <ktan-Utl/FKD7rXpskJ3/***@public.gmane.org<mailto:ktan-Utl/FKD7rXpskJ3/***@public.gmane.org>> wrote:

> On Jun 17, 2014, at 14:28, Jaap Keuter <jaap.keuter-qWit8jRvyhVmR6Xm/***@public.gmane.org<mailto:jaap.keuter-qWit8jRvyhVmR6Xm/***@public.gmane.org>> wrote:
>
>> On 06/17/2014 08:42 PM, Kok-Yong Tan wrote:
>> Is it possible to use Wireshark to troubleshoot a DSL "link no surf" problem? The ISP insists it's a CPE issue but the problem only started after their Tier 1 tech monkeyed with the DSLAM and/or the CPE (remotely) in some manner. I find it suspicious that the problem was intermittent packet loss until they tinkered, whereupon the problem became a "link no surf" issue (i.e., there's Layer 2 connectivity but zero Layer 3 traffic passing).
>
> Depends on what you can trace in the CPE, as in, how close to the DSL interface.
> Otherwise you'll need capture hardware on the DSL....
>
> Good luck,
> Jaap
>

I can get up to the DSL modem itself. In hindsight, I'm thinking this isn't going to be of much use and the only way to debug this is with capture hardware on the DSL side as you suggested. Drat.
--
Sent from my iPad2 with greater chance of typographical, grammatical and other disasters. Your indulgence is even more humbly requested.
___________________________________________________________________________
Sent via: Wireshark-users mailing list <wireshark-users-IZ8446WsY0/***@public.gmane.org<mailto:wireshark-users-IZ8446WsY0/***@public.gmane.org>>
Archives: http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
mailto:wireshark-users-request-IZ8446WsY0/***@public.gmane.org<mailto:wireshark-users-request-IZ8446WsY0/***@public.gmane.org>?subject=unsubscribe



--
Best regards / Mvh
Jan Pedro Tumusok

___________________________________________________________________________
Sent via: Wireshark-users mailing list <wireshark-users-IZ8446WsY0/***@public.gmane.org<mailto:wireshark-users-IZ8446WsY0/***@public.gmane.org>>
Archives: http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
mailto:wireshark-users-request-IZ8446WsY0/***@public.gmane.org?subject=unsubscribe

[Frank Bulk]

Some Comtrend modems can do a port mirror of the WAN (DSL) side.

Frank

-----Original Message-----
From: wireshark-users-bounces-IZ8446WsY0/***@public.gmane.org
[mailto:wireshark-users-bounces-IZ8446WsY0/***@public.gmane.org] On Behalf Of Kok-Yong Tan
Sent: Tuesday, June 17, 2014 4:53 PM
To: Community support list for Wireshark
Subject: Re: [Wireshark-users] Using Wireshark for a DSL "link no surf"
problem


> On Jun 17, 2014, at 14:28, Jaap Keuter <jaap.keuter-qWit8jRvyhVmR6Xm/***@public.gmane.org> wrote:
>
>> On 06/17/2014 08:42 PM, Kok-Yong Tan wrote:
>> Is it possible to use Wireshark to troubleshoot a DSL "link no surf"
problem? The ISP insists it's a CPE issue but the problem only started
after their Tier 1 tech monkeyed with the DSLAM and/or the CPE (remotely) in
some manner. I find it suspicious that the problem was intermittent packet
loss until they tinkered, whereupon the problem became a "link no surf"
issue (i.e., there's Layer 2 connectivity but zero Layer 3 traffic passing).
>
> Depends on what you can trace in the CPE, as in, how close to the DSL
interface.
> Otherwise you'll need capture hardware on the DSL....
>
> Good luck,
> Jaap
>

I can get up to the DSL modem itself. In hindsight, I'm thinking this isn't
going to be of much use and the only way to debug this is with capture
hardware on the DSL side as you suggested. Drat.
--
Sent from my iPad2 with greater chance of typographical, grammatical and
other disasters. Your indulgence is even more humbly requested.

___________________________________________________________________________
Sent via: Wireshark-users mailing list <wireshark-users-IZ8446WsY0/***@public.gmane.org>
Archives: http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
mailto:wireshark-users-request-IZ8446WsY0/***@public.gmane.org?subject=unsubscribe

[Pedro Tumusok]

Well if the tech can see stuff, its not what I thought might be the
problem, which was PVC settings.

But does your modem get an IP address, ie is it setup as a router or does
your computer get the ip address?
Are you using PPPoA/PPPoE etc?


On Wed, Jun 18, 2014 at 5:52 AM, Frank Bulk <frnkblk-***@public.gmane.org> wrote:

> Some Comtrend modems can do a port mirror of the WAN (DSL) side.
>
> Frank
>
> -----Original Message-----
> From: wireshark-users-bounces-IZ8446WsY0/***@public.gmane.org
> [mailto:wireshark-users-bounces-IZ8446WsY0/***@public.gmane.org] On Behalf Of Kok-Yong Tan
> Sent: Tuesday, June 17, 2014 4:53 PM
> To: Community support list for Wireshark
> Subject: Re: [Wireshark-users] Using Wireshark for a DSL "link no surf"
> problem
>
>
> > On Jun 17, 2014, at 14:28, Jaap Keuter <jaap.keuter-qWit8jRvyhVmR6Xm/***@public.gmane.org> wrote:
> >
> >> On 06/17/2014 08:42 PM, Kok-Yong Tan wrote:
> >> Is it possible to use Wireshark to troubleshoot a DSL "link no surf"
> problem? The ISP insists it's a CPE issue but the problem only started
> after their Tier 1 tech monkeyed with the DSLAM and/or the CPE (remotely)
> in
> some manner. I find it suspicious that the problem was intermittent packet
> loss until they tinkered, whereupon the problem became a "link no surf"
> issue (i.e., there's Layer 2 connectivity but zero Layer 3 traffic
> passing).
> >
> > Depends on what you can trace in the CPE, as in, how close to the DSL
> interface.
> > Otherwise you'll need capture hardware on the DSL....
> >
> > Good luck,
> > Jaap
> >
>
> I can get up to the DSL modem itself. In hindsight, I'm thinking this
> isn't
> going to be of much use and the only way to debug this is with capture
> hardware on the DSL side as you suggested. Drat.
> --
> Sent from my iPad2 with greater chance of typographical, grammatical and
> other disasters. Your indulgence is even more humbly requested.
>
> ___________________________________________________________________________
> Sent via: Wireshark-users mailing list <wireshark-users-IZ8446WsY0/***@public.gmane.org>
> Archives: http://www.wireshark.org/lists/wireshark-users
> Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
> mailto:wireshark-users-request-IZ8446WsY0/***@public.gmane.org
> ?subject=unsubscribe
>



--
Best regards / Mvh
Jan Pedro Tumusok

[Kok-Yong Tan]

No, the DSL modem is bridging, not routing. I've been assigned two static IPs (although they've given me a /24 net mask!!!) and my firewall is assigned one of them. The firewall is connected directly to the DSL modem by Cat6 patch cable. The other IP is unused (I use it for testing VPN configurations).

I'm not sure but since the Broadxent Briteport is a PPPoE modem, I assume PPPoE. But the tech says that's not correct (WTF?). And he can't explain what they use. Sigh.
--
Reality Artisans, Inc. # Network Wrangling and Delousing
P.O. Box 565, Gracie Station # Apple Certified Consultant
New York, NY 10028-0019 # Apple Consultants Network member
<http://www.realityartisans.com> # Apple Developer Connection member
Cell: [phone] # Ofc: [phone]

On Jun 17, 2014, at 22:13 , Pedro Tumusok <pedro.tumusok-***@public.gmane.org> wrote:

> Well if the tech can see stuff, its not what I thought might be the problem, which was PVC settings.
>
> But does your modem get an IP address, ie is it setup as a router or does your computer get the ip address?
> Are you using PPPoA/PPPoE etc?
>
>
> On Wed, Jun 18, 2014 at 5:52 AM, Frank Bulk <frnkblk-***@public.gmane.org> wrote:
> Some Comtrend modems can do a port mirror of the WAN (DSL) side.
>
> Frank
>
> -----Original Message-----
> From: wireshark-users-bounces-IZ8446WsY0/***@public.gmane.org
> [mailto:wireshark-users-bounces-IZ8446WsY0/***@public.gmane.org] On Behalf Of Kok-Yong Tan
> Sent: Tuesday, June 17, 2014 4:53 PM
> To: Community support list for Wireshark
> Subject: Re: [Wireshark-users] Using Wireshark for a DSL "link no surf"
> problem
>
>
> > On Jun 17, 2014, at 14:28, Jaap Keuter <jaap.keuter-qWit8jRvyhVmR6Xm/***@public.gmane.org> wrote:
> >
> >> On 06/17/2014 08:42 PM, Kok-Yong Tan wrote:
> >> Is it possible to use Wireshark to troubleshoot a DSL "link no surf"
> problem? The ISP insists it's a CPE issue but the problem only started
> after their Tier 1 tech monkeyed with the DSLAM and/or the CPE (remotely) in
> some manner. I find it suspicious that the problem was intermittent packet
> loss until they tinkered, whereupon the problem became a "link no surf"
> issue (i.e., there's Layer 2 connectivity but zero Layer 3 traffic passing).
> >
> > Depends on what you can trace in the CPE, as in, how close to the DSL
> interface.
> > Otherwise you'll need capture hardware on the DSL....
> >
> > Good luck,
> > Jaap
> >
>
> I can get up to the DSL modem itself. In hindsight, I'm thinking this isn't
> going to be of much use and the only way to debug this is with capture
> hardware on the DSL side as you suggested. Drat.
> --
> Sent from my iPad2 with greater chance of typographical, grammatical and
> other disasters. Your indulgence is even more humbly requested.
>
> ___________________________________________________________________________
> Sent via: Wireshark-users mailing list <wireshark-users-IZ8446WsY0/***@public.gmane.org>
> Archives: http://www.wireshark.org/lists/wireshark-users
> Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
> mailto:wireshark-users-request-IZ8446WsY0/***@public.gmane.org?subject=unsubscribe
>
>
>
> --
> Best regards / Mvh
> Jan Pedro Tumusok
>
> ___________________________________________________________________________
> Sent via: Wireshark-users mailing list <wireshark-users-IZ8446WsY0/***@public.gmane.org>
> Archives: http://www.wireshark.org/lists/wireshark-users
> Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
> mailto:wireshark-users-request-IZ8446WsY0/***@public.gmane.org?subject=unsubscribe

[Jamie O. Montgomery]

PPPoE is used for authentication. If you have a static IP, they know who has it and you don't need authentication. PPPoE would be the termination point for the address, but since it will reside on your firewall, the modem needs to bridge the dsl network to the Ethernet network on the public side if the firewall

They give you a /24 because they'd be burning up more IPv4 addresses giving you a smaller subnet. Other static IP customers use addresses in that subnet along with you.

Jamie Montgomery | Comporium
Network Facilities Engineering | Engineering Associate II
www.comporium.com<http://www.comporium.com/>
jamie.montgomery-***@public.gmane.org<mailto:jamie.montgomery-***@public.gmane.org>

The information contained in this e-mail message and any attachments thereto are confidential, privileged, or otherwise protected from disclosure, and are intended for the use of the individual or entity named above. Dissemination, distribution or copying of this message and any attachments by anyone other than the intended recipient, or an employee or agent responsible for delivering the message to the intended recipient, is prohibited. If you have received this communication in error, please immediately notify the sender by telephone or e-mail and destroy the original message, attachments, and all copies.

On Jun 18, 2014, at 1:34 PM, "Kok-Yong Tan" <ktan-Utl/FKD7rXpskJ3/***@public.gmane.org<mailto:ktan-Utl/FKD7rXpskJ3/***@public.gmane.org>> wrote:

No, the DSL modem is bridging, not routing. I've been assigned two static IPs (although they've given me a /24 net mask!!!) and my firewall is assigned one of them. The firewall is connected directly to the DSL modem by Cat6 patch cable. The other IP is unused (I use it for testing VPN configurations).

I'm not sure but since the Broadxent Briteport is a PPPoE modem, I assume PPPoE. But the tech says that's not correct (WTF?). And he can't explain what they use. Sigh.
--
Reality Artisans, Inc. # Network Wrangling and Delousing
P.O. Box 565, Gracie Station # Apple Certified Consultant
New York, NY 10028-0019 # Apple Consultants Network member
<http://www.realityartisans.com<http://www.realityartisans.com/>> # Apple Developer Connection member
Cell: [phone] # Ofc: [phone]

On Jun 17, 2014, at 22:13 , Pedro Tumusok <pedro.tumusok-***@public.gmane.org<mailto:pedro.tumusok-***@public.gmane.org>> wrote:

Well if the tech can see stuff, its not what I thought might be the problem, which was PVC settings.

But does your modem get an IP address, ie is it setup as a router or does your computer get the ip address?
Are you using PPPoA/PPPoE etc?


On Wed, Jun 18, 2014 at 5:52 AM, Frank Bulk <frnkblk-***@public.gmane.org<mailto:frnkblk-***@public.gmane.org>> wrote:
Some Comtrend modems can do a port mirror of the WAN (DSL) side.

Frank

-----Original Message-----
From: wireshark-users-bounces-IZ8446WsY0/***@public.gmane.org<mailto:wireshark-users-***@wireshark.org>
[mailto:wireshark-users-bounces-IZ8446WsY0/***@public.gmane.org<mailto:wireshark-users-***@wireshark.org>] On Behalf Of Kok-Yong Tan
Sent: Tuesday, June 17, 2014 4:53 PM
To: Community support list for Wireshark
Subject: Re: [Wireshark-users] Using Wireshark for a DSL "link no surf"
problem


> On Jun 17, 2014, at 14:28, Jaap Keuter <jaap.keuter-qWit8jRvyhVmR6Xm/***@public.gmane.org<mailto:jaap.keuter-qWit8jRvyhVmR6Xm/***@public.gmane.org>> wrote:
>
>> On 06/17/2014 08:42 PM, Kok-Yong Tan wrote:
>> Is it possible to use Wireshark to troubleshoot a DSL "link no surf"
problem? The ISP insists it's a CPE issue but the problem only started
after their Tier 1 tech monkeyed with the DSLAM and/or the CPE (remotely) in
some manner. I find it suspicious that the problem was intermittent packet
loss until they tinkered, whereupon the problem became a "link no surf"
issue (i.e., there's Layer 2 connectivity but zero Layer 3 traffic passing).
>
> Depends on what you can trace in the CPE, as in, how close to the DSL
interface.
> Otherwise you'll need capture hardware on the DSL....
>
> Good luck,
> Jaap
>

I can get up to the DSL modem itself. In hindsight, I'm thinking this isn't
going to be of much use and the only way to debug this is with capture
hardware on the DSL side as you suggested. Drat.
--
Sent from my iPad2 with greater chance of typographical, grammatical and
other disasters. Your indulgence is even more humbly requested.

___________________________________________________________________________
Sent via: Wireshark-users mailing list <wireshark-users-IZ8446WsY0/***@public.gmane.org<mailto:wireshark-users-IZ8446WsY0/***@public.gmane.org>>
Archives: http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
mailto:wireshark-users-request-IZ8446WsY0/***@public.gmane.org<mailto:wireshark-users-request-IZ8446WsY0/***@public.gmane.org>?subject=unsubscribe



--
Best regards / Mvh
Jan Pedro Tumusok

___________________________________________________________________________
Sent via: Wireshark-users mailing list <wireshark-users-IZ8446WsY0/***@public.gmane.org<mailto:wireshark-users-IZ8446WsY0/***@public.gmane.org>>
Archives: http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
mailto:wireshark-users-request-IZ8446WsY0/***@public.gmane.org?subject=unsubscribe

___________________________________________________________________________
Sent via: Wireshark-users mailing list <wireshark-users-IZ8446WsY0/***@public.gmane.org<mailto:wireshark-users-IZ8446WsY0/***@public.gmane.org>>
Archives: http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
mailto:wireshark-users-request-IZ8446WsY0/***@public.gmane.org?subject=unsubscribe

[Kok-Yong Tan]

Yes, I understand why they gave me a /24 but with a /24, all it takes is for somebody else on the same subnet to accidentally (not intentionally or maliciously for obvious reasons) take my static IP and thus blow me out of the water without affecting them too much. I had this happen once. With a subnet between /24 and /30, they'd notice when their accidentally typo-ed IP address didn't work because it didn't match their gateway info.
--
Reality Artisans, Inc. # Network Wrangling and Delousing
P.O. Box 565, Gracie Station # Apple Certified Consultant
New York, NY 10028-0019 # Apple Consultants Network member
<http://www.realityartisans.com> # Apple Developer Connection member
Cell: [phone] # Ofc: [phone]

On Jun 18, 2014, at 10:59 , "Jamie O. Montgomery" <Jamie.Montgomery-***@public.gmane.org> wrote:

> PPPoE is used for authentication. If you have a static IP, they know who has it and you don't need authentication. PPPoE would be the termination point for the address, but since it will reside on your firewall, the modem needs to bridge the dsl network to the Ethernet network on the public side if the firewall
>
> They give you a /24 because they'd be burning up more IPv4 addresses giving you a smaller subnet. Other static IP customers use addresses in that subnet along with you.
>
> Jamie Montgomery | Comporium
>
> Network Facilities Engineering | Engineering Associate II
>
> www.comporium.com
>
> jamie.montgomery-***@public.gmane.org
>
>
>
> The information contained in this e-mail message and any attachments thereto are confidential, privileged, or otherwise protected from disclosure, and are intended for the use of the individual or entity named above. Dissemination, distribution or copying of this message and any attachments by anyone other than the intended recipient, or an employee or agent responsible for delivering the message to the intended recipient, is prohibited. If you have received this communication in error, please immediately notify the sender by telephone or e-mail and destroy the original message, attachments, and all copies.
>
>
> On Jun 18, 2014, at 1:34 PM, "Kok-Yong Tan" <ktan-Utl/FKD7rXpskJ3/***@public.gmane.org> wrote:
>
>> No, the DSL modem is bridging, not routing. I've been assigned two static IPs (although they've given me a /24 net mask!!!) and my firewall is assigned one of them. The firewall is connected directly to the DSL modem by Cat6 patch cable. The other IP is unused (I use it for testing VPN configurations).
>>
>> I'm not sure but since the Broadxent Briteport is a PPPoE modem, I assume PPPoE. But the tech says that's not correct (WTF?). And he can't explain what they use. Sigh.
>> --
>> Reality Artisans, Inc.
>> # Network Wrangling and Delousing
>> P.O. Box 565, Gracie Station
>> # Apple Certified Consultant
>> New York, NY 10028-0019
>> # Apple Consultants Network member
>> <http://www.realityartisans.com>
>> # Apple Developer Connection member
>> Cell: [phone]
>> # Ofc: [phone]
>>
>> On Jun 17, 2014, at 22:13 , Pedro Tumusok <pedro.tumusok-***@public.gmane.org> wrote:
>>
>>> Well if the tech can see stuff, its not what I thought might be the problem, which was PVC settings.
>>>
>>> But does your modem get an IP address, ie is it setup as a router or does your computer get the ip address?
>>> Are you using PPPoA/PPPoE etc?
>>>
>>>
>>> On Wed, Jun 18, 2014 at 5:52 AM, Frank Bulk <frnkblk-***@public.gmane.org> wrote:
>>> Some Comtrend modems can do a port mirror of the WAN (DSL) side.
>>>
>>> Frank
>>>
>>> -----Original Message-----
>>> From: wireshark-users-bounces-IZ8446WsY0/***@public.gmane.org
>>> [mailto:wireshark-users-bounces-IZ8446WsY0/***@public.gmane.org] On Behalf Of Kok-Yong Tan
>>> Sent: Tuesday, June 17, 2014 4:53 PM
>>> To: Community support list for Wireshark
>>> Subject: Re: [Wireshark-users] Using Wireshark for a DSL "link no surf"
>>> problem
>>>
>>>
>>> > On Jun 17, 2014, at 14:28, Jaap Keuter <jaap.keuter-qWit8jRvyhVmR6Xm/***@public.gmane.org> wrote:
>>> >
>>> >> On 06/17/2014 08:42 PM, Kok-Yong Tan wrote:
>>> >> Is it possible to use Wireshark to troubleshoot a DSL "link no surf"
>>> problem? The ISP insists it's a CPE issue but the problem only started
>>> after their Tier 1 tech monkeyed with the DSLAM and/or the CPE (remotely) in
>>> some manner. I find it suspicious that the problem was intermittent packet
>>> loss until they tinkered, whereupon the problem became a "link no surf"
>>> issue (i.e., there's Layer 2 connectivity but zero Layer 3 traffic passing).
>>> >
>>> > Depends on what you can trace in the CPE, as in, how close to the DSL
>>> interface.
>>> > Otherwise you'll need capture hardware on the DSL....
>>> >
>>> > Good luck,
>>> > Jaap
>>> >
>>>
>>> I can get up to the DSL modem itself. In hindsight, I'm thinking this isn't
>>> going to be of much use and the only way to debug this is with capture
>>> hardware on the DSL side as you suggested. Drat.
>>> --
>>> Sent from my iPad2 with greater chance of typographical, grammatical and
>>> other disasters. Your indulgence is even more humbly requested.
>>>
>>> ___________________________________________________________________________
>>> Sent via: Wireshark-users mailing list <wireshark-users-IZ8446WsY0/***@public.gmane.org>
>>> Archives: http://www.wireshark.org/lists/wireshark-users
>>> Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
>>> mailto:wireshark-users-request-IZ8446WsY0/***@public.gmane.org?subject=unsubscribe
>>>
>>>
>>>
>>> --
>>> Best regards / Mvh
>>> Jan Pedro Tumusok
>>>
>>> ___________________________________________________________________________
>>> Sent via: Wireshark-users mailing list <wireshark-users-IZ8446WsY0/***@public.gmane.org>
>>> Archives: http://www.wireshark.org/lists/wireshark-users
>>> Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
>>> mailto:wireshark-users-request-IZ8446WsY0/***@public.gmane.org?subject=unsubscribe
>>
>> ___________________________________________________________________________
>> Sent via: Wireshark-users mailing list <wireshark-users-IZ8446WsY0/***@public.gmane.org>
>> Archives: http://www.wireshark.org/lists/wireshark-users
>> Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
>> mailto:wireshark-users-request-IZ8446WsY0/***@public.gmane.org?subject=unsubscribe
> ___________________________________________________________________________
> Sent via: Wireshark-users mailing list <wireshark-users-IZ8446WsY0/***@public.gmane.org>
> Archives: http://www.wireshark.org/lists/wireshark-users
> Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
> mailto:wireshark-users-request-IZ8446WsY0/***@public.gmane.org?subject=unsubscribe

[Pedro Tumusok]

If the DSL Led is on, on your modem, the DSLAM interface is up.
If the PVC is changed, then you should not see any L2 data, do a packet
capture and see if you can see data coming from your modem.

Pedro


On Wed, Jun 18, 2014 at 8:58 PM, Kok-Yong Tan <ktan-Utl/FKD7rXpskJ3/***@public.gmane.org>
wrote:

> Yes, I understand why they gave me a /24 but with a /24, all it takes is
> for somebody else on the same subnet to accidentally (not intentionally or
> maliciously for obvious reasons) take my static IP and thus blow me out of
> the water without affecting them too much. I had this happen once. With a
> subnet between /24 and /30, they'd notice when their accidentally typo-ed
> IP address didn't work because it didn't match their gateway info.
>
> --
> Reality Artisans, Inc. # Network Wrangling and Delousing
> P.O. Box 565, Gracie Station # Apple Certified Consultant
> New York, NY 10028-0019 # Apple Consultants Network member
> <http://www.realityartisans.com> # Apple Developer Connection member
> Cell: [phone] # Ofc: [phone]
>
> On Jun 18, 2014, at 10:59 , "Jamie O. Montgomery" <
> Jamie.Montgomery-***@public.gmane.org> wrote:
>
> PPPoE is used for authentication. If you have a static IP, they know who
> has it and you don't need authentication. PPPoE would be the termination
> point for the address, but since it will reside on your firewall, the modem
> needs to bridge the dsl network to the Ethernet network on the public side
> if the firewall
>
> They give you a /24 because they'd be burning up more IPv4 addresses
> giving you a smaller subnet. Other static IP customers use addresses in
> that subnet along with you.
>
> *Jamie Montgomery | Comporium*
>
> Network Facilities Engineering | Engineering Associate II
>
> www.comporium.com
>
> jamie.montgomery-***@public.gmane.org
>
>
> *The information contained in this e-mail message and any attachments
> thereto are confidential, privileged, or otherwise protected from
> disclosure, and are intended for the use of the individual or entity named
> above. Dissemination, distribution or copying of this message and any
> attachments by anyone other than the intended recipient, or an employee or
> agent responsible for delivering the message to the intended recipient, is
> prohibited. If you have received this communication in error, please
> immediately notify the sender by telephone or e-mail and destroy the
> original message, attachments, and all copies.*
>
> On Jun 18, 2014, at 1:34 PM, "Kok-Yong Tan" <ktan-Utl/FKD7rXpskJ3/***@public.gmane.org>
> wrote:
>
> No, the DSL modem is bridging, not routing. I've been assigned two
> static IPs (although they've given me a /24 net mask!!!) and my firewall is
> assigned one of them. The firewall is connected directly to the DSL modem
> by Cat6 patch cable. The other IP is unused (I use it for testing VPN
> configurations).
>
> I'm not sure but since the Broadxent Briteport is a PPPoE modem, I
> assume PPPoE. But the tech says that's not correct (WTF?). And he can't
> explain what they use. Sigh.
> --
> Reality Artisans, Inc. # Network Wrangling and Delousing
> P.O. Box 565, Gracie Station # Apple Certified Consultant
> New York, NY 10028-0019 # Apple Consultants Network member
> <http://www.realityartisans.com> # Apple Developer Connection member
> Cell: [phone] # Ofc: [phone]
>
> On Jun 17, 2014, at 22:13 , Pedro Tumusok <pedro.tumusok-***@public.gmane.org>
> wrote:
>
> Well if the tech can see stuff, its not what I thought might be the
> problem, which was PVC settings.
>
> But does your modem get an IP address, ie is it setup as a router or
> does your computer get the ip address?
> Are you using PPPoA/PPPoE etc?
>
>
> On Wed, Jun 18, 2014 at 5:52 AM, Frank Bulk <frnkblk-***@public.gmane.org> wrote:
>
>> Some Comtrend modems can do a port mirror of the WAN (DSL) side.
>>
>> Frank
>>
>> -----Original Message-----
>> From: wireshark-users-bounces-IZ8446WsY0/***@public.gmane.org
>> [mailto:wireshark-users-bounces-IZ8446WsY0/***@public.gmane.org] On Behalf Of Kok-Yong Tan
>> Sent: Tuesday, June 17, 2014 4:53 PM
>> To: Community support list for Wireshark
>> Subject: Re: [Wireshark-users] Using Wireshark for a DSL "link no surf"
>> problem
>>
>>
>> > On Jun 17, 2014, at 14:28, Jaap Keuter <jaap.keuter-qWit8jRvyhVmR6Xm/***@public.gmane.org> wrote:
>> >
>> >> On 06/17/2014 08:42 PM, Kok-Yong Tan wrote:
>> >> Is it possible to use Wireshark to troubleshoot a DSL "link no surf"
>> problem? The ISP insists it's a CPE issue but the problem only started
>> after their Tier 1 tech monkeyed with the DSLAM and/or the CPE (remotely)
>> in
>> some manner. I find it suspicious that the problem was intermittent
>> packet
>> loss until they tinkered, whereupon the problem became a "link no surf"
>> issue (i.e., there's Layer 2 connectivity but zero Layer 3 traffic
>> passing).
>> >
>> > Depends on what you can trace in the CPE, as in, how close to the DSL
>> interface.
>> > Otherwise you'll need capture hardware on the DSL....
>> >
>> > Good luck,
>> > Jaap
>> >
>>
>> I can get up to the DSL modem itself. In hindsight, I'm thinking this
>> isn't
>> going to be of much use and the only way to debug this is with capture
>> hardware on the DSL side as you suggested. Drat.
>> --
>> Sent from my iPad2 with greater chance of typographical, grammatical and
>> other disasters. Your indulgence is even more humbly requested.
>>
>>
>> ___________________________________________________________________________
>> Sent via: Wireshark-users mailing list <wireshark-users-IZ8446WsY0/***@public.gmane.org>
>> Archives: http://www.wireshark.org/lists/wireshark-users
>> Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
>> mailto:wireshark-users-request-IZ8446WsY0/***@public.gmane.org
>> ?subject=unsubscribe
>>
>
>
>
> --
> Best regards / Mvh
> Jan Pedro Tumusok
>
>
> ___________________________________________________________________________
> Sent via: Wireshark-users mailing list <wireshark-users-IZ8446WsY0/***@public.gmane.org>
> Archives: http://www.wireshark.org/lists/wireshark-users
> Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
>
> mailto:wireshark-users-request-IZ8446WsY0/***@public.gmane.org?subject=unsubscribe
> <wireshark-users-request-IZ8446WsY0/***@public.gmane.org?subject=unsubscribe>
>
>
>
> ___________________________________________________________________________
> Sent via: Wireshark-users mailing list <wireshark-users-IZ8446WsY0/***@public.gmane.org>
> Archives: http://www.wireshark.org/lists/wireshark-users
> Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
>
> mailto:wireshark-users-request-IZ8446WsY0/***@public.gmane.org?subject=unsubscribe
> <wireshark-users-request-IZ8446WsY0/***@public.gmane.org?subject=unsubscribe>
>
>
> ___________________________________________________________________________
> Sent via: Wireshark-users mailing list <wireshark-users-IZ8446WsY0/***@public.gmane.org>
> Archives: http://www.wireshark.org/lists/wireshark-users
> Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
>
> mailto:wireshark-users-request-IZ8446WsY0/***@public.gmane.org?subject=unsubscribe
> <wireshark-users-request-IZ8446WsY0/***@public.gmane.org?subject=unsubscribe>
>
>
>
> ___________________________________________________________________________
> Sent via: Wireshark-users mailing list <wireshark-users-IZ8446WsY0/***@public.gmane.org>
> Archives: http://www.wireshark.org/lists/wireshark-users
> Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
> mailto:wireshark-users-request-IZ8446WsY0/***@public.gmane.org
> ?subject=unsubscribe
>



--
Best regards / Mvh
Jan Pedro Tumusok

[Kok-Yong Tan]

Okay. Then my DSLAM interface is definitely up because I've got a solid (non blinking) green light on the LED for the DSL connection.

Problem is: How to do a packet capture since I can only access traffic off the ethernet (RJ45) port and not the DSL (RJ11/RJ14) port?
--
Reality Artisans, Inc. # Network Wrangling and Delousing
P.O. Box 565, Gracie Station # Apple Certified Consultant
New York, NY 10028-0019 # Apple Consultants Network member
<http://www.realityartisans.com> # Apple Developer Connection member
Cell: [phone] # Ofc: [phone]

On Jun 18, 2014, at 14:12 , Pedro Tumusok <pedro.tumusok-***@public.gmane.org> wrote:

> If the DSL Led is on, on your modem, the DSLAM interface is up.
> If the PVC is changed, then you should not see any L2 data, do a packet capture and see if you can see data coming from your modem.
>
> Pedro
>
>
> On Wed, Jun 18, 2014 at 8:58 PM, Kok-Yong Tan <ktan-Utl/FKD7rXpskJ3/***@public.gmane.org> wrote:
> Yes, I understand why they gave me a /24 but with a /24, all it takes is for somebody else on the same subnet to accidentally (not intentionally or maliciously for obvious reasons) take my static IP and thus blow me out of the water without affecting them too much. I had this happen once. With a subnet between /24 and /30, they'd notice when their accidentally typo-ed IP address didn't work because it didn't match their gateway info.
>
> --
> Reality Artisans, Inc. # Network Wrangling and Delousing
> P.O. Box 565, Gracie Station # Apple Certified Consultant
> New York, NY 10028-0019 # Apple Consultants Network member
> <http://www.realityartisans.com> # Apple Developer Connection member
> Cell: [phone] # Ofc: [phone]
>
> On Jun 18, 2014, at 10:59 , "Jamie O. Montgomery" <Jamie.Montgomery-***@public.gmane.org> wrote:
>
>> PPPoE is used for authentication. If you have a static IP, they know who has it and you don't need authentication. PPPoE would be the termination point for the address, but since it will reside on your firewall, the modem needs to bridge the dsl network to the Ethernet network on the public side if the firewall
>>
>> They give you a /24 because they'd be burning up more IPv4 addresses giving you a smaller subnet. Other static IP customers use addresses in that subnet along with you.
>>
>> Jamie Montgomery | Comporium
>>
>> Network Facilities Engineering | Engineering Associate II
>>
>> www.comporium.com
>>
>> jamie.montgomery-***@public.gmane.org
>>
>>
>>
>> The information contained in this e-mail message and any attachments thereto are confidential, privileged, or otherwise protected from disclosure, and are intended for the use of the individual or entity named above. Dissemination, distribution or copying of this message and any attachments by anyone other than the intended recipient, or an employee or agent responsible for delivering the message to the intended recipient, is prohibited. If you have received this communication in error, please immediately notify the sender by telephone or e-mail and destroy the original message, attachments, and all copies.
>>
>>
>> On Jun 18, 2014, at 1:34 PM, "Kok-Yong Tan" <ktan-Utl/FKD7rXpskJ3/***@public.gmane.org> wrote:
>>
>>> No, the DSL modem is bridging, not routing. I've been assigned two static IPs (although they've given me a /24 net mask!!!) and my firewall is assigned one of them. The firewall is connected directly to the DSL modem by Cat6 patch cable. The other IP is unused (I use it for testing VPN configurations).
>>>
>>> I'm not sure but since the Broadxent Briteport is a PPPoE modem, I assume PPPoE. But the tech says that's not correct (WTF?). And he can't explain what they use. Sigh.
>>> --
>>> Reality Artisans, Inc.
>>> # Network Wrangling and Delousing
>>> P.O. Box 565, Gracie Station
>>> # Apple Certified Consultant
>>> New York, NY 10028-0019
>>> # Apple Consultants Network member
>>> <http://www.realityartisans.com>
>>> # Apple Developer Connection member
>>> Cell: [phone]
>>> # Ofc: [phone]
>>>
>>> On Jun 17, 2014, at 22:13 , Pedro Tumusok <pedro.tumusok-***@public.gmane.org> wrote:
>>>
>>>> Well if the tech can see stuff, its not what I thought might be the problem, which was PVC settings.
>>>>
>>>> But does your modem get an IP address, ie is it setup as a router or does your computer get the ip address?
>>>> Are you using PPPoA/PPPoE etc?
>>>>
>>>>
>>>> On Wed, Jun 18, 2014 at 5:52 AM, Frank Bulk <frnkblk-***@public.gmane.org> wrote:
>>>> Some Comtrend modems can do a port mirror of the WAN (DSL) side.
>>>>
>>>> Frank
>>>>
>>>> -----Original Message-----
>>>> From: wireshark-users-bounces-IZ8446WsY0/***@public.gmane.org
>>>> [mailto:wireshark-users-bounces-IZ8446WsY0/***@public.gmane.org] On Behalf Of Kok-Yong Tan
>>>> Sent: Tuesday, June 17, 2014 4:53 PM
>>>> To: Community support list for Wireshark
>>>> Subject: Re: [Wireshark-users] Using Wireshark for a DSL "link no surf"
>>>> problem
>>>>
>>>>
>>>> > On Jun 17, 2014, at 14:28, Jaap Keuter <jaap.keuter-qWit8jRvyhVmR6Xm/***@public.gmane.org> wrote:
>>>> >
>>>> >> On 06/17/2014 08:42 PM, Kok-Yong Tan wrote:
>>>> >> Is it possible to use Wireshark to troubleshoot a DSL "link no surf"
>>>> problem? The ISP insists it's a CPE issue but the problem only started
>>>> after their Tier 1 tech monkeyed with the DSLAM and/or the CPE (remotely) in
>>>> some manner. I find it suspicious that the problem was intermittent packet
>>>> loss until they tinkered, whereupon the problem became a "link no surf"
>>>> issue (i.e., there's Layer 2 connectivity but zero Layer 3 traffic passing).
>>>> >
>>>> > Depends on what you can trace in the CPE, as in, how close to the DSL
>>>> interface.
>>>> > Otherwise you'll need capture hardware on the DSL....
>>>> >
>>>> > Good luck,
>>>> > Jaap
>>>> >
>>>>
>>>> I can get up to the DSL modem itself. In hindsight, I'm thinking this isn't
>>>> going to be of much use and the only way to debug this is with capture
>>>> hardware on the DSL side as you suggested. Drat.
>>>> --
>>>> Sent from my iPad2 with greater chance of typographical, grammatical and
>>>> other disasters. Your indulgence is even more humbly requested.
>>>>
>>>> ___________________________________________________________________________
>>>> Sent via: Wireshark-users mailing list <wireshark-users-IZ8446WsY0/***@public.gmane.org>
>>>> Archives: http://www.wireshark.org/lists/wireshark-users
>>>> Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
>>>> mailto:wireshark-users-request-IZ8446WsY0/***@public.gmane.org?subject=unsubscribe
>>>>
>>>>
>>>>
>>>> --
>>>> Best regards / Mvh
>>>> Jan Pedro Tumusok
>>>>
>>>> ___________________________________________________________________________
>>>> Sent via: Wireshark-users mailing list <wireshark-users-IZ8446WsY0/***@public.gmane.org>
>>>> Archives: http://www.wireshark.org/lists/wireshark-users
>>>> Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
>>>> mailto:wireshark-users-request-IZ8446WsY0/***@public.gmane.org?subject=unsubscribe
>>>
>>> ___________________________________________________________________________
>>> Sent via: Wireshark-users mailing list <wireshark-users-IZ8446WsY0/***@public.gmane.org>
>>> Archives: http://www.wireshark.org/lists/wireshark-users
>>> Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
>>> mailto:wireshark-users-request-IZ8446WsY0/***@public.gmane.org?subject=unsubscribe
>> ___________________________________________________________________________
>> Sent via: Wireshark-users mailing list <wireshark-users-IZ8446WsY0/***@public.gmane.org>
>> Archives: http://www.wireshark.org/lists/wireshark-users
>> Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
>> mailto:wireshark-users-request-IZ8446WsY0/***@public.gmane.org?subject=unsubscribe
>
>
> ___________________________________________________________________________
> Sent via: Wireshark-users mailing list <wireshark-users-IZ8446WsY0/***@public.gmane.org>
> Archives: http://www.wireshark.org/lists/wireshark-users
> Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
> mailto:wireshark-users-request-IZ8446WsY0/***@public.gmane.org?subject=unsubscribe
>
>
>
> --
> Best regards / Mvh
> Jan Pedro Tumusok
>
> ___________________________________________________________________________
> Sent via: Wireshark-users mailing list <wireshark-users-IZ8446WsY0/***@public.gmane.org>
> Archives: http://www.wireshark.org/lists/wireshark-users
> Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
> mailto:wireshark-users-request-IZ8446WsY0/***@public.gmane.org?subject=unsubscribe

[Pedro Tumusok]

You said your modem is in bridge mode, so any traffic arriving on the WAN
port should be forwarded out the LAN port, so just do it on that. If you
see any L2 data ie arp etc then the PVC are correct.

Have you tried configuring your firewall to ask for an IP instead of a
static setup.

Pedro


On Wed, Jun 18, 2014 at 11:21 PM, Kok-Yong Tan <ktan-Utl/FKD7rXpskJ3/***@public.gmane.org>
wrote:

> Okay. Then my DSLAM interface is definitely up because I've got a solid
> (non blinking) green light on the LED for the DSL connection.
>
> Problem is: How to do a packet capture since I can only access traffic off
> the ethernet (RJ45) port and not the DSL (RJ11/RJ14) port?
>
> --
> Reality Artisans, Inc. # Network Wrangling and Delousing
> P.O. Box 565, Gracie Station # Apple Certified Consultant
> New York, NY 10028-0019 # Apple Consultants Network member
> <http://www.realityartisans.com> # Apple Developer Connection member
> Cell: [phone] # Ofc: [phone]
>
> On Jun 18, 2014, at 14:12 , Pedro Tumusok <pedro.tumusok-***@public.gmane.org> wrote:
>
> If the DSL Led is on, on your modem, the DSLAM interface is up.
> If the PVC is changed, then you should not see any L2 data, do a packet
> capture and see if you can see data coming from your modem.
>
> Pedro
>
>
> On Wed, Jun 18, 2014 at 8:58 PM, Kok-Yong Tan <ktan-Utl/FKD7rXpskJ3/***@public.gmane.org>
> wrote:
>
>> Yes, I understand why they gave me a /24 but with a /24, all it takes is
>> for somebody else on the same subnet to accidentally (not intentionally or
>> maliciously for obvious reasons) take my static IP and thus blow me out of
>> the water without affecting them too much. I had this happen once. With a
>> subnet between /24 and /30, they'd notice when their accidentally typo-ed
>> IP address didn't work because it didn't match their gateway info.
>>
>> --
>> Reality Artisans, Inc. # Network Wrangling and Delousing
>> P.O. Box 565, Gracie Station # Apple Certified Consultant
>> New York, NY 10028-0019 # Apple Consultants Network member
>> <http://www.realityartisans.com> # Apple Developer Connection member
>> Cell: [phone] # Ofc: [phone]
>>
>> On Jun 18, 2014, at 10:59 , "Jamie O. Montgomery" <
>> Jamie.Montgomery-***@public.gmane.org> wrote:
>>
>> PPPoE is used for authentication. If you have a static IP, they know
>> who has it and you don't need authentication. PPPoE would be the
>> termination point for the address, but since it will reside on your
>> firewall, the modem needs to bridge the dsl network to the Ethernet network
>> on the public side if the firewall
>>
>> They give you a /24 because they'd be burning up more IPv4 addresses
>> giving you a smaller subnet. Other static IP customers use addresses in
>> that subnet along with you.
>>
>> *Jamie Montgomery | Comporium*
>>
>> Network Facilities Engineering | Engineering Associate II
>>
>> www.comporium.com
>>
>> jamie.montgomery-***@public.gmane.org
>>
>>
>> *The information contained in this e-mail message and any attachments
>> thereto are confidential, privileged, or otherwise protected from
>> disclosure, and are intended for the use of the individual or entity named
>> above. Dissemination, distribution or copying of this message and any
>> attachments by anyone other than the intended recipient, or an employee or
>> agent responsible for delivering the message to the intended recipient, is
>> prohibited. If you have received this communication in error, please
>> immediately notify the sender by telephone or e-mail and destroy the
>> original message, attachments, and all copies.*
>>
>> On Jun 18, 2014, at 1:34 PM, "Kok-Yong Tan" <ktan-Utl/FKD7rXpskJ3/***@public.gmane.org>
>> wrote:
>>
>> No, the DSL modem is bridging, not routing. I've been assigned two
>> static IPs (although they've given me a /24 net mask!!!) and my firewall is
>> assigned one of them. The firewall is connected directly to the DSL modem
>> by Cat6 patch cable. The other IP is unused (I use it for testing VPN
>> configurations).
>>
>> I'm not sure but since the Broadxent Briteport is a PPPoE modem, I
>> assume PPPoE. But the tech says that's not correct (WTF?). And he can't
>> explain what they use. Sigh.
>> --
>> Reality Artisans, Inc. # Network Wrangling and Delousing
>> P.O. Box 565, Gracie Station # Apple Certified Consultant
>> New York, NY 10028-0019 # Apple Consultants Network member
>> <http://www.realityartisans.com> # Apple Developer Connection member
>> Cell: [phone] # Ofc: [phone]
>>
>> On Jun 17, 2014, at 22:13 , Pedro Tumusok <pedro.tumusok-***@public.gmane.org>
>> wrote:
>>
>> Well if the tech can see stuff, its not what I thought might be the
>> problem, which was PVC settings.
>>
>> But does your modem get an IP address, ie is it setup as a router or
>> does your computer get the ip address?
>> Are you using PPPoA/PPPoE etc?
>>
>>
>> On Wed, Jun 18, 2014 at 5:52 AM, Frank Bulk <frnkblk-***@public.gmane.org> wrote:
>>
>>> Some Comtrend modems can do a port mirror of the WAN (DSL) side.
>>>
>>> Frank
>>>
>>> -----Original Message-----
>>> From: wireshark-users-bounces-IZ8446WsY0/***@public.gmane.org
>>> [mailto:wireshark-users-bounces-IZ8446WsY0/***@public.gmane.org] On Behalf Of Kok-Yong Tan
>>> Sent: Tuesday, June 17, 2014 4:53 PM
>>> To: Community support list for Wireshark
>>> Subject: Re: [Wireshark-users] Using Wireshark for a DSL "link no surf"
>>> problem
>>>
>>>
>>> > On Jun 17, 2014, at 14:28, Jaap Keuter <jaap.keuter-qWit8jRvyhVmR6Xm/***@public.gmane.org> wrote:
>>> >
>>> >> On 06/17/2014 08:42 PM, Kok-Yong Tan wrote:
>>> >> Is it possible to use Wireshark to troubleshoot a DSL "link no surf"
>>> problem? The ISP insists it's a CPE issue but the problem only started
>>> after their Tier 1 tech monkeyed with the DSLAM and/or the CPE
>>> (remotely) in
>>> some manner. I find it suspicious that the problem was intermittent
>>> packet
>>> loss until they tinkered, whereupon the problem became a "link no surf"
>>> issue (i.e., there's Layer 2 connectivity but zero Layer 3 traffic
>>> passing).
>>> >
>>> > Depends on what you can trace in the CPE, as in, how close to the DSL
>>> interface.
>>> > Otherwise you'll need capture hardware on the DSL....
>>> >
>>> > Good luck,
>>> > Jaap
>>> >
>>>
>>> I can get up to the DSL modem itself. In hindsight, I'm thinking this
>>> isn't
>>> going to be of much use and the only way to debug this is with capture
>>> hardware on the DSL side as you suggested. Drat.
>>> --
>>> Sent from my iPad2 with greater chance of typographical, grammatical and
>>> other disasters. Your indulgence is even more humbly requested.
>>>
>>>
>>> ___________________________________________________________________________
>>> Sent via: Wireshark-users mailing list <wireshark-users-IZ8446WsY0/***@public.gmane.org
>>> >
>>> Archives: http://www.wireshark.org/lists/wireshark-users
>>> Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
>>> mailto:wireshark-users-request-IZ8446WsY0/***@public.gmane.org
>>> ?subject=unsubscribe
>>>
>>
>>
>>
>> --
>> Best regards / Mvh
>> Jan Pedro Tumusok
>>
>>
>> ___________________________________________________________________________
>> Sent via: Wireshark-users mailing list <wireshark-users-IZ8446WsY0/***@public.gmane.org>
>> Archives: http://www.wireshark.org/lists/wireshark-users
>> Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
>>
>> mailto:wireshark-users-request-IZ8446WsY0/***@public.gmane.org?subject=unsubscribe
>> <wireshark-users-request-IZ8446WsY0/***@public.gmane.org?subject=unsubscribe>
>>
>>
>>
>> ___________________________________________________________________________
>> Sent via: Wireshark-users mailing list <wireshark-users-IZ8446WsY0/***@public.gmane.org>
>> Archives: http://www.wireshark.org/lists/wireshark-users
>> Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
>>
>> mailto:wireshark-users-request-IZ8446WsY0/***@public.gmane.org?subject=unsubscribe
>> <wireshark-users-request-IZ8446WsY0/***@public.gmane.org?subject=unsubscribe>
>>
>>
>> ___________________________________________________________________________
>> Sent via: Wireshark-users mailing list <wireshark-users-IZ8446WsY0/***@public.gmane.org>
>> Archives: http://www.wireshark.org/lists/wireshark-users
>> Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
>>
>> mailto:wireshark-users-request-IZ8446WsY0/***@public.gmane.org?subject=unsubscribe
>> <wireshark-users-request-IZ8446WsY0/***@public.gmane.org?subject=unsubscribe>
>>
>>
>>
>>
>> ___________________________________________________________________________
>> Sent via: Wireshark-users mailing list <wireshark-users-IZ8446WsY0/***@public.gmane.org>
>> Archives: http://www.wireshark.org/lists/wireshark-users
>> Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
>> mailto:wireshark-users-request-IZ8446WsY0/***@public.gmane.org
>> ?subject=unsubscribe
>>
>
>
>
> --
> Best regards / Mvh
> Jan Pedro Tumusok
>
>
> ___________________________________________________________________________
> Sent via: Wireshark-users mailing list <wireshark-users-IZ8446WsY0/***@public.gmane.org>
> Archives: http://www.wireshark.org/lists/wireshark-users
> Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
>
> mailto:wireshark-users-request-IZ8446WsY0/***@public.gmane.org?subject=unsubscribe
> <wireshark-users-request-IZ8446WsY0/***@public.gmane.org?subject=unsubscribe>
>
>
>
> ___________________________________________________________________________
> Sent via: Wireshark-users mailing list <wireshark-users-IZ8446WsY0/***@public.gmane.org>
> Archives: http://www.wireshark.org/lists/wireshark-users
> Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
> mailto:wireshark-users-request-IZ8446WsY0/***@public.gmane.org
> ?subject=unsubscribe
>



--
Best regards / Mvh
Jan Pedro Tumusok

[Kok-Yong Tan]

Hmm…you've got a point. I'll give it a shot when I get back.

I've found that if I configure my firewall to ask for an IP, I get an IP in the private subnet of 192.168.1.0/24 and I've discovered that this is the out-of-band management subnet. It then allows me to tap into the DSL modem at 192.168.1.1. I also tried to do this by disconnecting my firewall from the DSL modem and then attaching my laptop directly to the DSL modem. This is confirmed by a Tier 2 tech support rep at the ISP. I get no IP in the public subnet.
--
Reality Artisans, Inc. # Network Wrangling and Delousing
P.O. Box 565, Gracie Station # Apple Certified Consultant
New York, NY 10028-0019 # Apple Consultants Network member
<http://www.realityartisans.com> # Apple Developer Connection member
Cell: [phone] # Ofc: [phone]

On Jun 18, 2014, at 14:31 , Pedro Tumusok <pedro.tumusok-***@public.gmane.org> wrote:

> You said your modem is in bridge mode, so any traffic arriving on the WAN port should be forwarded out the LAN port, so just do it on that. If you see any L2 data ie arp etc then the PVC are correct.
>
> Have you tried configuring your firewall to ask for an IP instead of a static setup.
>
> Pedro
>
>
> On Wed, Jun 18, 2014 at 11:21 PM, Kok-Yong Tan <ktan-Utl/FKD7rXpskJ3/***@public.gmane.org> wrote:
> Okay. Then my DSLAM interface is definitely up because I've got a solid (non blinking) green light on the LED for the DSL connection.
>
> Problem is: How to do a packet capture since I can only access traffic off the ethernet (RJ45) port and not the DSL (RJ11/RJ14) port?
>
> --
> Reality Artisans, Inc. # Network Wrangling and Delousing
> P.O. Box 565, Gracie Station # Apple Certified Consultant
> New York, NY 10028-0019 # Apple Consultants Network member
> <http://www.realityartisans.com> # Apple Developer Connection member
> Cell: [phone] # Ofc: [phone]
>
> On Jun 18, 2014, at 14:12 , Pedro Tumusok <pedro.tumusok-***@public.gmane.org> wrote:
>
>> If the DSL Led is on, on your modem, the DSLAM interface is up.
>> If the PVC is changed, then you should not see any L2 data, do a packet capture and see if you can see data coming from your modem.
>>
>> Pedro
>>
>>
>> On Wed, Jun 18, 2014 at 8:58 PM, Kok-Yong Tan <ktan-Utl/FKD7rXpskJ3/***@public.gmane.org> wrote:
>> Yes, I understand why they gave me a /24 but with a /24, all it takes is for somebody else on the same subnet to accidentally (not intentionally or maliciously for obvious reasons) take my static IP and thus blow me out of the water without affecting them too much. I had this happen once. With a subnet between /24 and /30, they'd notice when their accidentally typo-ed IP address didn't work because it didn't match their gateway info.
>>
>> --
>> Reality Artisans, Inc. # Network Wrangling and Delousing
>> P.O. Box 565, Gracie Station # Apple Certified Consultant
>> New York, NY 10028-0019 # Apple Consultants Network member
>> <http://www.realityartisans.com> # Apple Developer Connection member
>> Cell: [phone] # Ofc: [phone]
>>
>> On Jun 18, 2014, at 10:59 , "Jamie O. Montgomery" <Jamie.Montgomery-***@public.gmane.org> wrote:
>>
>>> PPPoE is used for authentication. If you have a static IP, they know who has it and you don't need authentication. PPPoE would be the termination point for the address, but since it will reside on your firewall, the modem needs to bridge the dsl network to the Ethernet network on the public side if the firewall
>>>
>>> They give you a /24 because they'd be burning up more IPv4 addresses giving you a smaller subnet. Other static IP customers use addresses in that subnet along with you.
>>>
>>> Jamie Montgomery | Comporium
>>>
>>> Network Facilities Engineering | Engineering Associate II
>>>
>>> www.comporium.com
>>>
>>> jamie.montgomery-***@public.gmane.org
>>>
>>>
>>>
>>> The information contained in this e-mail message and any attachments thereto are confidential, privileged, or otherwise protected from disclosure, and are intended for the use of the individual or entity named above. Dissemination, distribution or copying of this message and any attachments by anyone other than the intended recipient, or an employee or agent responsible for delivering the message to the intended recipient, is prohibited. If you have received this communication in error, please immediately notify the sender by telephone or e-mail and destroy the original message, attachments, and all copies.
>>>
>>>
>>> On Jun 18, 2014, at 1:34 PM, "Kok-Yong Tan" <ktan-Utl/FKD7rXpskJ3/***@public.gmane.org> wrote:
>>>
>>>> No, the DSL modem is bridging, not routing. I've been assigned two static IPs (although they've given me a /24 net mask!!!) and my firewall is assigned one of them. The firewall is connected directly to the DSL modem by Cat6 patch cable. The other IP is unused (I use it for testing VPN configurations).
>>>>
>>>> I'm not sure but since the Broadxent Briteport is a PPPoE modem, I assume PPPoE. But the tech says that's not correct (WTF?). And he can't explain what they use. Sigh.
>>>> --
>>>> Reality Artisans, Inc.
>>>> # Network Wrangling and Delousing
>>>> P.O. Box 565, Gracie Station
>>>> # Apple Certified Consultant
>>>> New York, NY 10028-0019
>>>> # Apple Consultants Network member
>>>> <http://www.realityartisans.com>
>>>> # Apple Developer Connection member
>>>> Cell: [phone]
>>>> # Ofc: [phone]
>>>>
>>>> On Jun 17, 2014, at 22:13 , Pedro Tumusok <pedro.tumusok-***@public.gmane.org> wrote:
>>>>
>>>>> Well if the tech can see stuff, its not what I thought might be the problem, which was PVC settings.
>>>>>
>>>>> But does your modem get an IP address, ie is it setup as a router or does your computer get the ip address?
>>>>> Are you using PPPoA/PPPoE etc?
>>>>>
>>>>>
>>>>> On Wed, Jun 18, 2014 at 5:52 AM, Frank Bulk <frnkblk-***@public.gmane.org> wrote:
>>>>> Some Comtrend modems can do a port mirror of the WAN (DSL) side.
>>>>>
>>>>> Frank
>>>>>
>>>>> -----Original Message-----
>>>>> From: wireshark-users-bounces-IZ8446WsY0/***@public.gmane.org
>>>>> [mailto:wireshark-users-bounces-IZ8446WsY0/***@public.gmane.org] On Behalf Of Kok-Yong Tan
>>>>> Sent: Tuesday, June 17, 2014 4:53 PM
>>>>> To: Community support list for Wireshark
>>>>> Subject: Re: [Wireshark-users] Using Wireshark for a DSL "link no surf"
>>>>> problem
>>>>>
>>>>>
>>>>> > On Jun 17, 2014, at 14:28, Jaap Keuter <jaap.keuter-qWit8jRvyhVmR6Xm/***@public.gmane.org> wrote:
>>>>> >
>>>>> >> On 06/17/2014 08:42 PM, Kok-Yong Tan wrote:
>>>>> >> Is it possible to use Wireshark to troubleshoot a DSL "link no surf"
>>>>> problem? The ISP insists it's a CPE issue but the problem only started
>>>>> after their Tier 1 tech monkeyed with the DSLAM and/or the CPE (remotely) in
>>>>> some manner. I find it suspicious that the problem was intermittent packet
>>>>> loss until they tinkered, whereupon the problem became a "link no surf"
>>>>> issue (i.e., there's Layer 2 connectivity but zero Layer 3 traffic passing).
>>>>> >
>>>>> > Depends on what you can trace in the CPE, as in, how close to the DSL
>>>>> interface.
>>>>> > Otherwise you'll need capture hardware on the DSL....
>>>>> >
>>>>> > Good luck,
>>>>> > Jaap
>>>>> >
>>>>>
>>>>> I can get up to the DSL modem itself. In hindsight, I'm thinking this isn't
>>>>> going to be of much use and the only way to debug this is with capture
>>>>> hardware on the DSL side as you suggested. Drat.
>>>>> --
>>>>> Sent from my iPad2 with greater chance of typographical, grammatical and
>>>>> other disasters. Your indulgence is even more humbly requested.
>>>>>
>>>>> ___________________________________________________________________________
>>>>> Sent via: Wireshark-users mailing list <wireshark-users-IZ8446WsY0/***@public.gmane.org>
>>>>> Archives: http://www.wireshark.org/lists/wireshark-users
>>>>> Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
>>>>> mailto:wireshark-users-request-IZ8446WsY0/***@public.gmane.org?subject=unsubscribe
>>>>>
>>>>>
>>>>>
>>>>> --
>>>>> Best regards / Mvh
>>>>> Jan Pedro Tumusok
>>>>>
>>>>> ___________________________________________________________________________
>>>>> Sent via: Wireshark-users mailing list <wireshark-users-IZ8446WsY0/***@public.gmane.org>
>>>>> Archives: http://www.wireshark.org/lists/wireshark-users
>>>>> Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
>>>>> mailto:wireshark-users-request-IZ8446WsY0/***@public.gmane.org?subject=unsubscribe
>>>>
>>>> ___________________________________________________________________________
>>>> Sent via: Wireshark-users mailing list <wireshark-users-IZ8446WsY0/***@public.gmane.org>
>>>> Archives: http://www.wireshark.org/lists/wireshark-users
>>>> Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
>>>> mailto:wireshark-users-request-IZ8446WsY0/***@public.gmane.org?subject=unsubscribe
>>> ___________________________________________________________________________
>>> Sent via: Wireshark-users mailing list <wireshark-users-IZ8446WsY0/***@public.gmane.org>
>>> Archives: http://www.wireshark.org/lists/wireshark-users
>>> Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
>>> mailto:wireshark-users-request-IZ8446WsY0/***@public.gmane.org?subject=unsubscribe
>>
>>
>> ___________________________________________________________________________
>> Sent via: Wireshark-users mailing list <wireshark-users-IZ8446WsY0/***@public.gmane.org>
>> Archives: http://www.wireshark.org/lists/wireshark-users
>> Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
>> mailto:wireshark-users-request-IZ8446WsY0/***@public.gmane.org?subject=unsubscribe
>>
>>
>>
>> --
>> Best regards / Mvh
>> Jan Pedro Tumusok
>>
>> ___________________________________________________________________________
>> Sent via: Wireshark-users mailing list <wireshark-users-IZ8446WsY0/***@public.gmane.org>
>> Archives: http://www.wireshark.org/lists/wireshark-users
>> Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
>> mailto:wireshark-users-request-IZ8446WsY0/***@public.gmane.org?subject=unsubscribe
>
>
> ___________________________________________________________________________
> Sent via: Wireshark-users mailing list <wireshark-users-IZ8446WsY0/***@public.gmane.org>
> Archives: http://www.wireshark.org/lists/wireshark-users
> Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
> mailto:wireshark-users-request-IZ8446WsY0/***@public.gmane.org?subject=unsubscribe
>
>
>
> --
> Best regards / Mvh
> Jan Pedro Tumusok
>
> ___________________________________________________________________________
> Sent via: Wireshark-users mailing list <wireshark-users-IZ8446WsY0/***@public.gmane.org>
> Archives: http://www.wireshark.org/lists/wireshark-users
> Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
> mailto:wireshark-users-request-IZ8446WsY0/***@public.gmane.org?subject=unsubscribe

[Frank Bulk]

Normally if a modem is in bridging mode it doesn't hand out IP addresses.
Something is not right here.



If you were my customer we'd have a tech onsite to assist a long time ago.



Frank



From: wireshark-users-bounces-IZ8446WsY0/***@public.gmane.org
[mailto:wireshark-users-bounces-IZ8446WsY0/***@public.gmane.org] On Behalf Of Kok-Yong Tan
Sent: Wednesday, June 18, 2014 4:41 PM
To: Community support list for Wireshark
Subject: Re: [Wireshark-users] Using Wireshark for a DSL "link no surf"
problem



Hmm.you've got a point. I'll give it a shot when I get back.



I've found that if I configure my firewall to ask for an IP, I get an IP in
the private subnet of 192.168.1.0/24 and I've discovered that this is the
out-of-band management subnet. It then allows me to tap into the DSL modem
at 192.168.1.1. I also tried to do this by disconnecting my firewall from
the DSL modem and then attaching my laptop directly to the DSL modem. This
is confirmed by a Tier 2 tech support rep at the ISP. I get no IP in the
public subnet.

--

Reality Artisans, Inc. # Network Wrangling and
Delousing
P.O. Box 565, Gracie Station # Apple Certified Consultant
New York, NY 10028-0019 # Apple Consultants Network member
<http://www.realityartisans.com <http://www.realityartisans.com/> > #
Apple Developer Connection member

Cell: [phone] # Ofc: [phone]



On Jun 18, 2014, at 14:31 , Pedro Tumusok <pedro.tumusok-***@public.gmane.org
<mailto:pedro.tumusok-***@public.gmane.org> > wrote:





You said your modem is in bridge mode, so any traffic arriving on the WAN
port should be forwarded out the LAN port, so just do it on that. If you see
any L2 data ie arp etc then the PVC are correct.



Have you tried configuring your firewall to ask for an IP instead of a
static setup.



Pedro



On Wed, Jun 18, 2014 at 11:21 PM, Kok-Yong Tan <ktan-Utl/FKD7rXpskJ3/***@public.gmane.org
<mailto:ktan-Utl/FKD7rXpskJ3/***@public.gmane.org> > wrote:

Okay. Then my DSLAM interface is definitely up because I've got a solid (non
blinking) green light on the LED for the DSL connection.



Problem is: How to do a packet capture since I can only access traffic off
the ethernet (RJ45) port and not the DSL (RJ11/RJ14) port?



--

Reality Artisans, Inc. # Network Wrangling and Delousing
P.O. Box 565, Gracie Station # Apple Certified Consultant
New York, NY 10028-0019 # Apple Consultants Network member
<http://www.realityartisans.com <http://www.realityartisans.com/> > #
Apple Developer Connection member

Cell: [phone] <tel:%28646%29%20327-2918> # Ofc: [phone]
<tel:%28212%29%20369-4876>



On Jun 18, 2014, at 14:12 , Pedro Tumusok <pedro.tumusok-***@public.gmane.org
<mailto:pedro.tumusok-***@public.gmane.org> > wrote:





If the DSL Led is on, on your modem, the DSLAM interface is up.

If the PVC is changed, then you should not see any L2 data, do a packet
capture and see if you can see data coming from your modem.



Pedro



On Wed, Jun 18, 2014 at 8:58 PM, Kok-Yong Tan <ktan-Utl/FKD7rXpskJ3/***@public.gmane.org
<mailto:ktan-Utl/FKD7rXpskJ3/***@public.gmane.org> > wrote:

Yes, I understand why they gave me a /24 but with a /24, all it takes is for
somebody else on the same subnet to accidentally (not intentionally or
maliciously for obvious reasons) take my static IP and thus blow me out of
the water without affecting them too much. I had this happen once. With a
subnet between /24 and /30, they'd notice when their accidentally typo-ed IP
address didn't work because it didn't match their gateway info.



--

Reality Artisans, Inc. # Network Wrangling and Delousing
P.O. Box 565, Gracie Station # Apple Certified Consultant
New York, NY 10028-0019 # Apple Consultants Network member
<http://www.realityartisans.com <http://www.realityartisans.com/> > #
Apple Developer Connection member

Cell: [phone] <tel:%28646%29%20327-2918> # Ofc: [phone]
<tel:%28212%29%20369-4876>



On Jun 18, 2014, at 10:59 , "Jamie O. Montgomery"
<Jamie.Montgomery-***@public.gmane.org <mailto:Jamie.Montgomery-***@public.gmane.org> >
wrote:





PPPoE is used for authentication. If you have a static IP, they know who has
it and you don't need authentication. PPPoE would be the termination point
for the address, but since it will reside on your firewall, the modem needs
to bridge the dsl network to the Ethernet network on the public side if the
firewall



They give you a /24 because they'd be burning up more IPv4 addresses giving
you a smaller subnet. Other static IP customers use addresses in that subnet
along with you.

Jamie Montgomery | Comporium

Network Facilities Engineering | Engineering Associate II

www.comporium.com <http://www.comporium.com/>

<mailto:jamie.montgomery-***@public.gmane.org> jamie.montgomery-***@public.gmane.org





The information contained in this e-mail message and any attachments thereto
are confidential, privileged, or otherwise protected from disclosure, and
are intended for the use of the individual or entity named above.
Dissemination, distribution or copying of this message and any attachments
by anyone other than the intended recipient, or an employee or agent
responsible for delivering the message to the intended recipient, is
prohibited. If you have received this communication in error, please
immediately notify the sender by telephone or e-mail and destroy the
original message, attachments, and all copies.


On Jun 18, 2014, at 1:34 PM, "Kok-Yong Tan" <ktan-Utl/FKD7rXpskJ3/***@public.gmane.org
<mailto:ktan-Utl/FKD7rXpskJ3/***@public.gmane.org> > wrote:

No, the DSL modem is bridging, not routing. I've been assigned two static
IPs (although they've given me a /24 net mask!!!) and my firewall is
assigned one of them. The firewall is connected directly to the DSL modem
by Cat6 patch cable. The other IP is unused (I use it for testing VPN
configurations).



I'm not sure but since the Broadxent Briteport is a PPPoE modem, I assume
PPPoE. But the tech says that's not correct (WTF?). And he can't explain
what they use. Sigh.

--

Reality Artisans, Inc. # Network Wrangling and Delousing
P.O. Box 565, Gracie Station # Apple Certified Consultant
New York, NY 10028-0019 # Apple Consultants Network member
<http://www.realityartisans.com <http://www.realityartisans.com/> > #
Apple Developer Connection member

Cell: [phone] <tel:%28646%29%20327-2918> # Ofc: [phone]
<tel:%28212%29%20369-4876>



On Jun 17, 2014, at 22:13 , Pedro Tumusok <pedro.tumusok-***@public.gmane.org
<mailto:pedro.tumusok-***@public.gmane.org> > wrote:





Well if the tech can see stuff, its not what I thought might be the problem,
which was PVC settings.



But does your modem get an IP address, ie is it setup as a router or does
your computer get the ip address?

Are you using PPPoA/PPPoE etc?



On Wed, Jun 18, 2014 at 5:52 AM, Frank Bulk <frnkblk-***@public.gmane.org
<mailto:frnkblk-***@public.gmane.org> > wrote:

Some Comtrend modems can do a port mirror of the WAN (DSL) side.

Frank


-----Original Message-----
From: wireshark-users-bounces-IZ8446WsY0/***@public.gmane.org
<mailto:wireshark-users-bounces-IZ8446WsY0/***@public.gmane.org>
[mailto:wireshark-users-bounces-IZ8446WsY0/***@public.gmane.org
<mailto:wireshark-users-bounces-IZ8446WsY0/***@public.gmane.org> ] On Behalf Of Kok-Yong Tan
Sent: Tuesday, June 17, 2014 4:53 PM
To: Community support list for Wireshark
Subject: Re: [Wireshark-users] Using Wireshark for a DSL "link no surf"
problem


> On Jun 17, 2014, at 14:28, Jaap Keuter <jaap.keuter-qWit8jRvyhVmR6Xm/***@public.gmane.org
<mailto:jaap.keuter-qWit8jRvyhVmR6Xm/***@public.gmane.org> > wrote:
>
>> On 06/17/2014 08:42 PM, Kok-Yong Tan wrote:
>> Is it possible to use Wireshark to troubleshoot a DSL "link no surf"
problem? The ISP insists it's a CPE issue but the problem only started
after their Tier 1 tech monkeyed with the DSLAM and/or the CPE (remotely) in
some manner. I find it suspicious that the problem was intermittent packet
loss until they tinkered, whereupon the problem became a "link no surf"
issue (i.e., there's Layer 2 connectivity but zero Layer 3 traffic passing).
>
> Depends on what you can trace in the CPE, as in, how close to the DSL
interface.
> Otherwise you'll need capture hardware on the DSL....
>
> Good luck,
> Jaap
>

I can get up to the DSL modem itself. In hindsight, I'm thinking this isn't
going to be of much use and the only way to debug this is with capture
hardware on the DSL side as you suggested. Drat.
--
Sent from my iPad2 with greater chance of typographical, grammatical and
other disasters. Your indulgence is even more humbly requested.

___________________________________________________________________________
Sent via: Wireshark-users mailing list <wireshark-users-IZ8446WsY0/***@public.gmane.org
<mailto:wireshark-users-IZ8446WsY0/***@public.gmane.org> >
Archives: http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
mailto:wireshark-users-request-IZ8446WsY0/***@public.gmane.org
<mailto:wireshark-users-request-IZ8446WsY0/***@public.gmane.org> ?subject=unsubscribe







--
Best regards / Mvh
Jan Pedro Tumusok

___________________________________________________________________________
Sent via: Wireshark-users mailing list <wireshark-users-IZ8446WsY0/***@public.gmane.org
<mailto:wireshark-users-IZ8446WsY0/***@public.gmane.org> >
Archives: http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
mailto:wireshark-users-request-IZ8446WsY0/***@public.gmane.org?subject=unsubscribe



___________________________________________________________________________
Sent via: Wireshark-users mailing list <wireshark-users-IZ8446WsY0/***@public.gmane.org
<mailto:wireshark-users-IZ8446WsY0/***@public.gmane.org> >
Archives: http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
mailto:wireshark-users-request-IZ8446WsY0/***@public.gmane.org?subject=unsubscribe

___________________________________________________________________________
Sent via: Wireshark-users mailing list <wireshark-users-IZ8446WsY0/***@public.gmane.org
<mailto:wireshark-users-IZ8446WsY0/***@public.gmane.org> >
Archives: http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
mailto:wireshark-users-request-IZ8446WsY0/***@public.gmane.org?subject=unsubscribe




___________________________________________________________________________
Sent via: Wireshark-users mailing list <wireshark-users-IZ8446WsY0/***@public.gmane.org
<mailto:wireshark-users-IZ8446WsY0/***@public.gmane.org> >
Archives: http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
mailto:wireshark-users-request-IZ8446WsY0/***@public.gmane.org
<mailto:wireshark-users-request-IZ8446WsY0/***@public.gmane.org> ?subject=unsubscribe







--
Best regards / Mvh
Jan Pedro Tumusok

___________________________________________________________________________
Sent via: Wireshark-users mailing list <wireshark-users-IZ8446WsY0/***@public.gmane.org
<mailto:wireshark-users-IZ8446WsY0/***@public.gmane.org> >
Archives: http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
mailto:wireshark-users-request-IZ8446WsY0/***@public.gmane.org?subject=unsubscribe




___________________________________________________________________________
Sent via: Wireshark-users mailing list <wireshark-users-IZ8446WsY0/***@public.gmane.org
<mailto:wireshark-users-IZ8446WsY0/***@public.gmane.org> >
Archives: http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
mailto:wireshark-users-request-IZ8446WsY0/***@public.gmane.org
<mailto:wireshark-users-request-IZ8446WsY0/***@public.gmane.org> ?subject=unsubscribe







--
Best regards / Mvh
Jan Pedro Tumusok

___________________________________________________________________________
Sent via: Wireshark-users mailing list <wireshark-users-IZ8446WsY0/***@public.gmane.org
<mailto:wireshark-users-IZ8446WsY0/***@public.gmane.org> >
Archives: http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
mailto:wireshark-users-request-IZ8446WsY0/***@public.gmane.org?subject=unsubscribe

[Kok-Yong Tan]

The DHCP IP address that the DSL modem hands out is in the private range (192.168.1.0/24 and in a very tiny pool of 1 address), not the public range. This constitutes "out of band" management. I have been assigned a static IP in the public range (i.e., not in the 10.0.0/8 nor 172.16.0.0/12 nor 192.168.0.0/16 ranges) As I mentioned, it was working fine until their bedamned tech support rep fiddled with my connection and the devices they were supposedly responsible for.
--
Reality Artisans, Inc. # Network Wrangling and Delousing
P.O. Box 565, Gracie Station # Apple Certified Consultant
New York, NY 10028-0019 # Apple Consultants Network member
<http://www.realityartisans.com> # Apple Developer Connection member
Cell: [phone] # Ofc: [phone]

On Jun 18, 2014, at 21:03 , Frank Bulk <frnkblk-***@public.gmane.org> wrote:

> Normally if a modem is in bridging mode it doesn’t hand out IP addresses. Something is not right here.
>
> If you were my customer we’d have a tech onsite to assist a long time ago.
>
> Frank
>
> From: wireshark-users-bounces-IZ8446WsY0/***@public.gmane.org [mailto:wireshark-users-bounces-IZ8446WsY0/***@public.gmane.org] On Behalf Of Kok-Yong Tan
> Sent: Wednesday, June 18, 2014 4:41 PM
> To: Community support list for Wireshark
> Subject: Re: [Wireshark-users] Using Wireshark for a DSL "link no surf" problem
>
> Hmm…you've got a point. I'll give it a shot when I get back.
>
> I've found that if I configure my firewall to ask for an IP, I get an IP in the private subnet of 192.168.1.0/24 and I've discovered that this is the out-of-band management subnet. It then allows me to tap into the DSL modem at 192.168.1.1. I also tried to do this by disconnecting my firewall from the DSL modem and then attaching my laptop directly to the DSL modem. This is confirmed by a Tier 2 tech support rep at the ISP. I get no IP in the public subnet.
> --
> Reality Artisans, Inc. # Network Wrangling and Delousing
> P.O. Box 565, Gracie Station # Apple Certified Consultant
> New York, NY 10028-0019 # Apple Consultants Network member
> <http://www.realityartisans.com> # Apple Developer Connection member
> Cell: [phone] # Ofc: [phone]
>
> On Jun 18, 2014, at 14:31 , Pedro Tumusok <pedro.tumusok-***@public.gmane.org> wrote:
>
>
> You said your modem is in bridge mode, so any traffic arriving on the WAN port should be forwarded out the LAN port, so just do it on that. If you see any L2 data ie arp etc then the PVC are correct.
>
> Have you tried configuring your firewall to ask for an IP instead of a static setup.
>
> Pedro
>
>
> On Wed, Jun 18, 2014 at 11:21 PM, Kok-Yong Tan <ktan-Utl/FKD7rXpskJ3/***@public.gmane.org> wrote:
> Okay. Then my DSLAM interface is definitely up because I've got a solid (non blinking) green light on the LED for the DSL connection.
>
> Problem is: How to do a packet capture since I can only access traffic off the ethernet (RJ45) port and not the DSL (RJ11/RJ14) port?
>
> --
> Reality Artisans, Inc. # Network Wrangling and Delousing
> P.O. Box 565, Gracie Station # Apple Certified Consultant
> New York, NY 10028-0019 # Apple Consultants Network member
> <http://www.realityartisans.com> # Apple Developer Connection member
> Cell: [phone] # Ofc: [phone]
>
> On Jun 18, 2014, at 14:12 , Pedro Tumusok <pedro.tumusok-***@public.gmane.org> wrote:
>
>
> If the DSL Led is on, on your modem, the DSLAM interface is up.
> If the PVC is changed, then you should not see any L2 data, do a packet capture and see if you can see data coming from your modem.
>
> Pedro
>
>
> On Wed, Jun 18, 2014 at 8:58 PM, Kok-Yong Tan <ktan-Utl/FKD7rXpskJ3/***@public.gmane.org> wrote:
> Yes, I understand why they gave me a /24 but with a /24, all it takes is for somebody else on the same subnet to accidentally (not intentionally or maliciously for obvious reasons) take my static IP and thus blow me out of the water without affecting them too much. I had this happen once. With a subnet between /24 and /30, they'd notice when their accidentally typo-ed IP address didn't work because it didn't match their gateway info.
>
> --
> Reality Artisans, Inc. # Network Wrangling and Delousing
> P.O. Box 565, Gracie Station # Apple Certified Consultant
> New York, NY 10028-0019 # Apple Consultants Network member
> <http://www.realityartisans.com> # Apple Developer Connection member
> Cell: [phone] # Ofc: [phone]
>
> On Jun 18, 2014, at 10:59 , "Jamie O. Montgomery" <Jamie.Montgomery-***@public.gmane.org> wrote:
>
>
> PPPoE is used for authentication. If you have a static IP, they know who has it and you don't need authentication. PPPoE would be the termination point for the address, but since it will reside on your firewall, the modem needs to bridge the dsl network to the Ethernet network on the public side if the firewall
>
> They give you a /24 because they'd be burning up more IPv4 addresses giving you a smaller subnet. Other static IP customers use addresses in that subnet along with you.
>
> Jamie Montgomery | Comporium
>
> Network Facilities Engineering | Engineering Associate II
>
> www.comporium.com
>
> jamie.montgomery-***@public.gmane.org
>
>
>
>
> The information contained in this e-mail message and any attachments thereto are confidential, privileged, or otherwise protected from disclosure, and are intended for the use of the individual or entity named above. Dissemination, distribution or copying of this message and any attachments by anyone other than the intended recipient, or an employee or agent responsible for delivering the message to the intended recipient, is prohibited. If you have received this communication in error, please immediately notify the sender by telephone or e-mail and destroy the original message, attachments, and all copies.
>
>
> On Jun 18, 2014, at 1:34 PM, "Kok-Yong Tan" <ktan-Utl/FKD7rXpskJ3/***@public.gmane.org> wrote:
>
> No, the DSL modem is bridging, not routing. I've been assigned two static IPs (although they've given me a /24 net mask!!!) and my firewall is assigned one of them. The firewall is connected directly to the DSL modem by Cat6 patch cable. The other IP is unused (I use it for testing VPN configurations).
>
> I'm not sure but since the Broadxent Briteport is a PPPoE modem, I assume PPPoE. But the tech says that's not correct (WTF?). And he can't explain what they use. Sigh.
> --
> Reality Artisans, Inc. # Network Wrangling and Delousing
> P.O. Box 565, Gracie Station # Apple Certified Consultant
> New York, NY 10028-0019 # Apple Consultants Network member
> <http://www.realityartisans.com> # Apple Developer Connection member
> Cell: [phone] # Ofc: [phone]
>
> On Jun 17, 2014, at 22:13 , Pedro Tumusok <pedro.tumusok-***@public.gmane.org> wrote:
>
>
> Well if the tech can see stuff, its not what I thought might be the problem, which was PVC settings.
>
> But does your modem get an IP address, ie is it setup as a router or does your computer get the ip address?
> Are you using PPPoA/PPPoE etc?
>
>
> On Wed, Jun 18, 2014 at 5:52 AM, Frank Bulk <frnkblk-***@public.gmane.org> wrote:
> Some Comtrend modems can do a port mirror of the WAN (DSL) side.
>
> Frank
>
> -----Original Message-----
> From: wireshark-users-bounces-IZ8446WsY0/***@public.gmane.org
> [mailto:wireshark-users-bounces-IZ8446WsY0/***@public.gmane.org] On Behalf Of Kok-Yong Tan
> Sent: Tuesday, June 17, 2014 4:53 PM
> To: Community support list for Wireshark
> Subject: Re: [Wireshark-users] Using Wireshark for a DSL "link no surf"
> problem
>
>
> > On Jun 17, 2014, at 14:28, Jaap Keuter <jaap.keuter-qWit8jRvyhVmR6Xm/***@public.gmane.org> wrote:
> >
> >> On 06/17/2014 08:42 PM, Kok-Yong Tan wrote:
> >> Is it possible to use Wireshark to troubleshoot a DSL "link no surf"
> problem? The ISP insists it's a CPE issue but the problem only started
> after their Tier 1 tech monkeyed with the DSLAM and/or the CPE (remotely) in
> some manner. I find it suspicious that the problem was intermittent packet
> loss until they tinkered, whereupon the problem became a "link no surf"
> issue (i.e., there's Layer 2 connectivity but zero Layer 3 traffic passing).
> >
> > Depends on what you can trace in the CPE, as in, how close to the DSL
> interface.
> > Otherwise you'll need capture hardware on the DSL....
> >
> > Good luck,
> > Jaap
> >
>
> I can get up to the DSL modem itself. In hindsight, I'm thinking this isn't
> going to be of much use and the only way to debug this is with capture
> hardware on the DSL side as you suggested. Drat.
> --
> Sent from my iPad2 with greater chance of typographical, grammatical and
> other disasters. Your indulgence is even more humbly requested.
>
> ___________________________________________________________________________
> Sent via: Wireshark-users mailing list <wireshark-users-IZ8446WsY0/***@public.gmane.org>
> Archives: http://www.wireshark.org/lists/wireshark-users
> Unsubscribe:https://wireshark.org/mailman/options/wireshark-users
> mailto:wireshark-users-request-IZ8446WsY0/***@public.gmane.org?subject=unsubscribe
>
>
>
> --
> Best regards / Mvh
> Jan Pedro Tumusok
>
> ___________________________________________________________________________
> Sent via: Wireshark-users mailing list <wireshark-users-IZ8446WsY0/***@public.gmane.org>
> Archives: http://www.wireshark.org/lists/wireshark-users
> Unsubscribe:https://wireshark.org/mailman/options/wireshark-users
> mailto:wireshark-users-request-IZ8446WsY0/***@public.gmane.org?subject=unsubscribe
>
> ___________________________________________________________________________
> Sent via: Wireshark-users mailing list <wireshark-users-IZ8446WsY0/***@public.gmane.org>
> Archives: http://www.wireshark.org/lists/wireshark-users
> Unsubscribe:https://wireshark.org/mailman/options/wireshark-users
> mailto:wireshark-users-request-IZ8446WsY0/***@public.gmane.org?subject=unsubscribe
> ___________________________________________________________________________
> Sent via: Wireshark-users mailing list <wireshark-users-IZ8446WsY0/***@public.gmane.org>
> Archives: http://www.wireshark.org/lists/wireshark-users
> Unsubscribe:https://wireshark.org/mailman/options/wireshark-users
> mailto:wireshark-users-request-IZ8446WsY0/***@public.gmane.org?subject=unsubscribe
>
>
> ___________________________________________________________________________
> Sent via: Wireshark-users mailing list <wireshark-users-IZ8446WsY0/***@public.gmane.org>
> Archives: http://www.wireshark.org/lists/wireshark-users
> Unsubscribe:https://wireshark.org/mailman/options/wireshark-users
> mailto:wireshark-users-request-IZ8446WsY0/***@public.gmane.org?subject=unsubscribe
>
>
>
> --
> Best regards / Mvh
> Jan Pedro Tumusok
>
> ___________________________________________________________________________
> Sent via: Wireshark-users mailing list <wireshark-users-IZ8446WsY0/***@public.gmane.org>
> Archives: http://www.wireshark.org/lists/wireshark-users
> Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
> mailto:wireshark-users-request-IZ8446WsY0/***@public.gmane.org?subject=unsubscribe
>
>
> ___________________________________________________________________________
> Sent via: Wireshark-users mailing list <wireshark-users-IZ8446WsY0/***@public.gmane.org>
> Archives: http://www.wireshark.org/lists/wireshark-users
> Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
> mailto:wireshark-users-request-IZ8446WsY0/***@public.gmane.org?subject=unsubscribe
>
>
>
> --
> Best regards / Mvh
> Jan Pedro Tumusok
>
> ___________________________________________________________________________
> Sent via: Wireshark-users mailing list <wireshark-users-IZ8446WsY0/***@public.gmane.org>
> Archives: http://www.wireshark.org/lists/wireshark-users
> Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
> mailto:wireshark-users-request-IZ8446WsY0/***@public.gmane.org?subject=unsubscribe
>
> ___________________________________________________________________________
> Sent via: Wireshark-users mailing list <wireshark-users-IZ8446WsY0/***@public.gmane.org>
> Archives: http://www.wireshark.org/lists/wireshark-users
> Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
> mailto:wireshark-users-request-IZ8446WsY0/***@public.gmane.org?subject=unsubscribe

[Frank Bulk]

If your service provider uses DHCP to hand out those "static" IPs, or their
access gear allows that IP address to be entered (which is the case with our
vendor's gear), the access gear prevents someone else taking your static IP.



Frank



From: wireshark-users-bounces-IZ8446WsY0/***@public.gmane.org
[mailto:wireshark-users-bounces-IZ8446WsY0/***@public.gmane.org] On Behalf Of Kok-Yong Tan
Sent: Wednesday, June 18, 2014 1:58 PM
To: Community support list for Wireshark
Subject: Re: [Wireshark-users] Using Wireshark for a DSL "link no surf"
problem



Yes, I understand why they gave me a /24 but with a /24, all it takes is for
somebody else on the same subnet to accidentally (not intentionally or
maliciously for obvious reasons) take my static IP and thus blow me out of
the water without affecting them too much. I had this happen once. With a
subnet between /24 and /30, they'd notice when their accidentally typo-ed IP
address didn't work because it didn't match their gateway info.

--

Reality Artisans, Inc. # Network Wrangling and
Delousing
P.O. Box 565, Gracie Station # Apple Certified Consultant
New York, NY 10028-0019 # Apple Consultants Network member
<http://www.realityartisans.com <http://www.realityartisans.com/> > #
Apple Developer Connection member

Cell: [phone] # Ofc: [phone]



On Jun 18, 2014, at 10:59 , "Jamie O. Montgomery"
<Jamie.Montgomery-***@public.gmane.org <mailto:Jamie.Montgomery-***@public.gmane.org> >
wrote:





PPPoE is used for authentication. If you have a static IP, they know who has
it and you don't need authentication. PPPoE would be the termination point
for the address, but since it will reside on your firewall, the modem needs
to bridge the dsl network to the Ethernet network on the public side if the
firewall



They give you a /24 because they'd be burning up more IPv4 addresses giving
you a smaller subnet. Other static IP customers use addresses in that subnet
along with you.

Jamie Montgomery | Comporium

Network Facilities Engineering | Engineering Associate II

www.comporium.com <http://www.comporium.com/>

<mailto:jamie.montgomery-***@public.gmane.org> jamie.montgomery-***@public.gmane.org





The information contained in this e-mail message and any attachments thereto
are confidential, privileged, or otherwise protected from disclosure, and
are intended for the use of the individual or entity named above.
Dissemination, distribution or copying of this message and any attachments
by anyone other than the intended recipient, or an employee or agent
responsible for delivering the message to the intended recipient, is
prohibited. If you have received this communication in error, please
immediately notify the sender by telephone or e-mail and destroy the
original message, attachments, and all copies.


On Jun 18, 2014, at 1:34 PM, "Kok-Yong Tan" <ktan-Utl/FKD7rXpskJ3/***@public.gmane.org
<mailto:ktan-Utl/FKD7rXpskJ3/***@public.gmane.org> > wrote:

No, the DSL modem is bridging, not routing. I've been assigned two static
IPs (although they've given me a /24 net mask!!!) and my firewall is
assigned one of them. The firewall is connected directly to the DSL modem
by Cat6 patch cable. The other IP is unused (I use it for testing VPN
configurations).



I'm not sure but since the Broadxent Briteport is a PPPoE modem, I assume
PPPoE. But the tech says that's not correct (WTF?). And he can't explain
what they use. Sigh.

--

Reality Artisans, Inc.

# Network Wrangling and Delousing
P.O. Box 565, Gracie Station

# Apple Certified Consultant
New York, NY 10028-0019

# Apple Consultants Network member
<http://www.realityartisans.com <http://www.realityartisans.com/> >

# Apple Developer Connection member

Cell: [phone]

# Ofc: [phone]



On Jun 17, 2014, at 22:13 , Pedro Tumusok <pedro.tumusok-***@public.gmane.org
<mailto:pedro.tumusok-***@public.gmane.org> > wrote:





Well if the tech can see stuff, its not what I thought might be the problem,
which was PVC settings.



But does your modem get an IP address, ie is it setup as a router or does
your computer get the ip address?

Are you using PPPoA/PPPoE etc?



On Wed, Jun 18, 2014 at 5:52 AM, Frank Bulk <frnkblk-***@public.gmane.org
<mailto:frnkblk-***@public.gmane.org> > wrote:

Some Comtrend modems can do a port mirror of the WAN (DSL) side.

Frank


-----Original Message-----
From: wireshark-users-bounces-IZ8446WsY0/***@public.gmane.org
<mailto:wireshark-users-bounces-IZ8446WsY0/***@public.gmane.org>
[mailto:wireshark-users-bounces-IZ8446WsY0/***@public.gmane.org
<mailto:wireshark-users-bounces-IZ8446WsY0/***@public.gmane.org> ] On Behalf Of Kok-Yong Tan
Sent: Tuesday, June 17, 2014 4:53 PM
To: Community support list for Wireshark
Subject: Re: [Wireshark-users] Using Wireshark for a DSL "link no surf"
problem


> On Jun 17, 2014, at 14:28, Jaap Keuter <jaap.keuter-qWit8jRvyhVmR6Xm/***@public.gmane.org
<mailto:jaap.keuter-qWit8jRvyhVmR6Xm/***@public.gmane.org> > wrote:
>
>> On 06/17/2014 08:42 PM, Kok-Yong Tan wrote:
>> Is it possible to use Wireshark to troubleshoot a DSL "link no surf"
problem? The ISP insists it's a CPE issue but the problem only started
after their Tier 1 tech monkeyed with the DSLAM and/or the CPE (remotely) in
some manner. I find it suspicious that the problem was intermittent packet
loss until they tinkered, whereupon the problem became a "link no surf"
issue (i.e., there's Layer 2 connectivity but zero Layer 3 traffic passing).
>
> Depends on what you can trace in the CPE, as in, how close to the DSL
interface.
> Otherwise you'll need capture hardware on the DSL....
>
> Good luck,
> Jaap
>

I can get up to the DSL modem itself. In hindsight, I'm thinking this isn't
going to be of much use and the only way to debug this is with capture
hardware on the DSL side as you suggested. Drat.
--
Sent from my iPad2 with greater chance of typographical, grammatical and
other disasters. Your indulgence is even more humbly requested.

___________________________________________________________________________
Sent via: Wireshark-users mailing list <wireshark-users-IZ8446WsY0/***@public.gmane.org
<mailto:wireshark-users-IZ8446WsY0/***@public.gmane.org> >
Archives: http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
mailto:wireshark-users-request-IZ8446WsY0/***@public.gmane.org
<mailto:wireshark-users-request-IZ8446WsY0/***@public.gmane.org> ?subject=unsubscribe







--
Best regards / Mvh
Jan Pedro Tumusok

___________________________________________________________________________
Sent via: Wireshark-users mailing list <wireshark-users-IZ8446WsY0/***@public.gmane.org
<mailto:wireshark-users-IZ8446WsY0/***@public.gmane.org> >
Archives: http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
mailto:wireshark-users-request-IZ8446WsY0/***@public.gmane.org?subject=unsubscribe



___________________________________________________________________________
Sent via: Wireshark-users mailing list <wireshark-users-IZ8446WsY0/***@public.gmane.org
<mailto:wireshark-users-IZ8446WsY0/***@public.gmane.org> >
Archives: http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
mailto:wireshark-users-request-IZ8446WsY0/***@public.gmane.org?subject=unsubscribe

___________________________________________________________________________
Sent via: Wireshark-users mailing list <wireshark-users-IZ8446WsY0/***@public.gmane.org
<mailto:wireshark-users-IZ8446WsY0/***@public.gmane.org> >
Archives: http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
mailto:wireshark-users-request-IZ8446WsY0/***@public.gmane.org?subject=unsubscribe

[Kok-Yong Tan]

The service provider doesn't use DHCP to hand out my static IPs. I was assigned them via an email. The DHCP server is on the DSL modem (not the DSLAM) and it hands out a single IP address in the 192.168.1.0/24 private range, namely 192.168.1.10. This is known as out-of-band management and only used for accessing the DSL modem itself and nothing else. The actual static addresses I'm assigned are in the public range while my DSL modem is supposedly set to bridging mode, i.e., it's not in the 10.0.0.0/8, 172.16.0.0/12 or 192.168.0.0/16 ranges.
--
Reality Artisans, Inc. # Network Wrangling and Delousing
P.O. Box 565, Gracie Station # Apple Certified Consultant
New York, NY 10028-0019 # Apple Consultants Network member
<http://www.realityartisans.com> # Apple Developer Connection member
Cell: [phone] # Ofc: [phone]

On Jun 18, 2014, at 21:02 , Frank Bulk <frnkblk-***@public.gmane.org> wrote:

> If your service provider uses DHCP to hand out those “static” IPs, or their access gear allows that IP address to be entered (which is the case with our vendor’s gear), the access gear prevents someone else taking your static IP.
>
> Frank
>
> From: wireshark-users-bounces-IZ8446WsY0/***@public.gmane.org [mailto:wireshark-users-bounces-IZ8446WsY0/***@public.gmane.org] On Behalf Of Kok-Yong Tan
> Sent: Wednesday, June 18, 2014 1:58 PM
> To: Community support list for Wireshark
> Subject: Re: [Wireshark-users] Using Wireshark for a DSL "link no surf" problem
>
> Yes, I understand why they gave me a /24 but with a /24, all it takes is for somebody else on the same subnet to accidentally (not intentionally or maliciously for obvious reasons) take my static IP and thus blow me out of the water without affecting them too much. I had this happen once. With a subnet between /24 and /30, they'd notice when their accidentally typo-ed IP address didn't work because it didn't match their gateway info.
> --
> Reality Artisans, Inc. # Network Wrangling and Delousing
> P.O. Box 565, Gracie Station # Apple Certified Consultant
> New York, NY 10028-0019 # Apple Consultants Network member
> <http://www.realityartisans.com> # Apple Developer Connection member
> Cell: [phone] # Ofc: [phone]
>
> On Jun 18, 2014, at 10:59 , "Jamie O. Montgomery" <Jamie.Montgomery-***@public.gmane.org> wrote:
>
>
> PPPoE is used for authentication. If you have a static IP, they know who has it and you don't need authentication. PPPoE would be the termination point for the address, but since it will reside on your firewall, the modem needs to bridge the dsl network to the Ethernet network on the public side if the firewall
>
> They give you a /24 because they'd be burning up more IPv4 addresses giving you a smaller subnet. Other static IP customers use addresses in that subnet along with you.
>
> Jamie Montgomery | Comporium
>
> Network Facilities Engineering | Engineering Associate II
>
> www.comporium.com
>
> jamie.montgomery-***@public.gmane.org
>
>
>
>
> The information contained in this e-mail message and any attachments thereto are confidential, privileged, or otherwise protected from disclosure, and are intended for the use of the individual or entity named above. Dissemination, distribution or copying of this message and any attachments by anyone other than the intended recipient, or an employee or agent responsible for delivering the message to the intended recipient, is prohibited. If you have received this communication in error, please immediately notify the sender by telephone or e-mail and destroy the original message, attachments, and all copies.
>
>
> On Jun 18, 2014, at 1:34 PM, "Kok-Yong Tan" <ktan-Utl/FKD7rXpskJ3/***@public.gmane.org> wrote:
>
> No, the DSL modem is bridging, not routing. I've been assigned two static IPs (although they've given me a /24 net mask!!!) and my firewall is assigned one of them. The firewall is connected directly to the DSL modem by Cat6 patch cable. The other IP is unused (I use it for testing VPN configurations).
>
> I'm not sure but since the Broadxent Briteport is a PPPoE modem, I assume PPPoE. But the tech says that's not correct (WTF?). And he can't explain what they use. Sigh.
> --
> Reality Artisans, Inc.
> # Network Wrangling and Delousing
> P.O. Box 565, Gracie Station
> # Apple Certified Consultant
> New York, NY 10028-0019
> # Apple Consultants Network member
> <http://www.realityartisans.com>
> # Apple Developer Connection member
> Cell: [phone]
> # Ofc: [phone]
>
> On Jun 17, 2014, at 22:13 , Pedro Tumusok <pedro.tumusok-***@public.gmane.org> wrote:
>
>
> Well if the tech can see stuff, its not what I thought might be the problem, which was PVC settings.
>
> But does your modem get an IP address, ie is it setup as a router or does your computer get the ip address?
> Are you using PPPoA/PPPoE etc?
>
>
> On Wed, Jun 18, 2014 at 5:52 AM, Frank Bulk <frnkblk-***@public.gmane.org> wrote:
> Some Comtrend modems can do a port mirror of the WAN (DSL) side.
>
> Frank
>
> -----Original Message-----
> From: wireshark-users-bounces-IZ8446WsY0/***@public.gmane.org
> [mailto:wireshark-users-bounces-IZ8446WsY0/***@public.gmane.org] On Behalf Of Kok-Yong Tan
> Sent: Tuesday, June 17, 2014 4:53 PM
> To: Community support list for Wireshark
> Subject: Re: [Wireshark-users] Using Wireshark for a DSL "link no surf"
> problem
>
>
> > On Jun 17, 2014, at 14:28, Jaap Keuter <jaap.keuter-qWit8jRvyhVmR6Xm/***@public.gmane.org> wrote:
> >
> >> On 06/17/2014 08:42 PM, Kok-Yong Tan wrote:
> >> Is it possible to use Wireshark to troubleshoot a DSL "link no surf"
> problem? The ISP insists it's a CPE issue but the problem only started
> after their Tier 1 tech monkeyed with the DSLAM and/or the CPE (remotely) in
> some manner. I find it suspicious that the problem was intermittent packet
> loss until they tinkered, whereupon the problem became a "link no surf"
> issue (i.e., there's Layer 2 connectivity but zero Layer 3 traffic passing).
> >
> > Depends on what you can trace in the CPE, as in, how close to the DSL
> interface.
> > Otherwise you'll need capture hardware on the DSL....
> >
> > Good luck,
> > Jaap
> >
>
> I can get up to the DSL modem itself. In hindsight, I'm thinking this isn't
> going to be of much use and the only way to debug this is with capture
> hardware on the DSL side as you suggested. Drat.
> --
> Sent from my iPad2 with greater chance of typographical, grammatical and
> other disasters. Your indulgence is even more humbly requested.
>
> ___________________________________________________________________________
> Sent via: Wireshark-users mailing list <wireshark-users-IZ8446WsY0/***@public.gmane.org>
> Archives: http://www.wireshark.org/lists/wireshark-users
> Unsubscribe:https://wireshark.org/mailman/options/wireshark-users
> mailto:wireshark-users-request-IZ8446WsY0/***@public.gmane.org?subject=unsubscribe
>
>
>
> --
> Best regards / Mvh
> Jan Pedro Tumusok
>
> ___________________________________________________________________________
> Sent via: Wireshark-users mailing list <wireshark-users-IZ8446WsY0/***@public.gmane.org>
> Archives: http://www.wireshark.org/lists/wireshark-users
> Unsubscribe:https://wireshark.org/mailman/options/wireshark-users
> mailto:wireshark-users-request-IZ8446WsY0/***@public.gmane.org?subject=unsubscribe
>
> ___________________________________________________________________________
> Sent via: Wireshark-users mailing list <wireshark-users-IZ8446WsY0/***@public.gmane.org>
> Archives: http://www.wireshark.org/lists/wireshark-users
> Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
> mailto:wireshark-users-request-IZ8446WsY0/***@public.gmane.org?subject=unsubscribe
> ___________________________________________________________________________
> Sent via: Wireshark-users mailing list <wireshark-users-IZ8446WsY0/***@public.gmane.org>
> Archives: http://www.wireshark.org/lists/wireshark-users
> Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
> mailto:wireshark-users-request-IZ8446WsY0/***@public.gmane.org?subject=unsubscribe
>
> ___________________________________________________________________________
> Sent via: Wireshark-users mailing list <wireshark-users-IZ8446WsY0/***@public.gmane.org>
> Archives: http://www.wireshark.org/lists/wireshark-users
> Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
> mailto:wireshark-users-request-IZ8446WsY0/***@public.gmane.org?subject=unsubscribe

[Martin Visser]

There seems to be a lot of contradicting answers on this thread. PPPoE is
used for authentication AND link negotiation (ie providing IP addresses)
AND encapsulation. If you have a PPPoE modem in passthrough (which is what
it sounds you are doing), the modem is just pretty much doing physical
level translation between your DSL and Ethernet, and then your router
(normally) is establish the PPPoE session. If you aren't able to capture
traffic at the router and/or want to test locally you can use a PPPoE
client on a laptop, for instance, and which also can run wireshark. Not
sure what you have a available, but if you plug your Windows laptop into
your modem directly, and then run through the Internet connection wizard
(as per the example here - http://www.tp-link.com.au/article/?faqid=339 )
while running Wireshark you may have a better clue as to what is going on
(or not).


Regards, Martin

MartinVisser99-***@public.gmane.org


On 19 June 2014 16:14, Kok-Yong Tan <ktan-Utl/FKD7rXpskJ3/***@public.gmane.org> wrote:

> The service provider doesn't use DHCP to hand out my static IPs. I was
> assigned them via an email. The DHCP server is on the DSL modem (not the
> DSLAM) and it hands out a single IP address in the 192.168.1.0/24 private
> range, namely 192.168.1.10. This is known as out-of-band management and
> only used for accessing the DSL modem itself and nothing else. The actual
> static addresses I'm assigned are in the public range while my DSL modem is
> supposedly set to bridging mode, i.e., it's not in the 10.0.0.0/8,
> 172.16.0.0/12 or 192.168.0.0/16 ranges.
>
> --
> Reality Artisans, Inc. # Network Wrangling and Delousing
> P.O. Box 565, Gracie Station # Apple Certified Consultant
> New York, NY 10028-0019 # Apple Consultants Network member
> <http://www.realityartisans.com> # Apple Developer Connection member
> Cell: [phone] # Ofc: [phone]
>
> On Jun 18, 2014, at 21:02 , Frank Bulk <frnkblk-***@public.gmane.org> wrote:
>
> If your service provider uses DHCP to hand out those “static” IPs, or
> their access gear allows that IP address to be entered (which is the case
> with our vendor’s gear), the access gear prevents someone else taking your
> static IP.
>
> Frank
>
> *From:* wireshark-users-bounces-IZ8446WsY0/***@public.gmane.org [mailto:wireshark-
> users-bounces-IZ8446WsY0/***@public.gmane.org] *On Behalf Of *Kok-Yong Tan
> *Sent:* Wednesday, June 18, 2014 1:58 PM
> *To:* Community support list for Wireshark
> *Subject:* Re: [Wireshark-users] Using Wireshark for a DSL "link no surf"
> problem
>
> Yes, I understand why they gave me a /24 but with a /24, all it takes is
> for somebody else on the same subnet to accidentally (not intentionally or
> maliciously for obvious reasons) take my static IP and thus blow me out of
> the water without affecting them too much. I had this happen once. With a
> subnet between /24 and /30, they'd notice when their accidentally typo-ed
> IP address didn't work because it didn't match their gateway info.
> --
> Reality Artisans, Inc. # Network Wrangling and
> Delousing
> P.O. Box 565, Gracie Station # Apple Certified Consultant
> New York, NY 10028-0019 # Apple Consultants Network
> member
> <http://www.realityartisans.com> # Apple Developer Connection
> member
> Cell: [phone] # Ofc: [phone]
>
> On Jun 18, 2014, at 10:59 , "Jamie O. Montgomery" <
> Jamie.Montgomery-***@public.gmane.org> wrote:
>
>
> PPPoE is used for authentication. If you have a static IP, they know who
> has it and you don't need authentication. PPPoE would be the termination
> point for the address, but since it will reside on your firewall, the modem
> needs to bridge the dsl network to the Ethernet network on the public side
> if the firewall
>
>
> They give you a /24 because they'd be burning up more IPv4 addresses
> giving you a smaller subnet. Other static IP customers use addresses in
> that subnet along with you.
>
> *Jamie Montgomery | Comporium*
>
> Network Facilities Engineering | Engineering Associate II
>
> www.comporium.com
>
> jamie.montgomery-***@public.gmane.org
>
>
>
> *The information contained in this e-mail message and any attachments
> thereto are confidential, privileged, or otherwise protected from
> disclosure, and are intended for the use of the individual or entity named
> above. Dissemination, distribution or copying of this message and any
> attachments by anyone other than the intended recipient, or an employee or
> agent responsible for delivering the message to the intended recipient, is
> prohibited. If you have received this communication in error, please
> immediately notify the sender by telephone or e-mail and destroy the
> original message, attachments, and all copies.*
>
>
> On Jun 18, 2014, at 1:34 PM, "Kok-Yong Tan" <ktan-Utl/FKD7rXpskJ3/***@public.gmane.org>
> wrote:
>
> No, the DSL modem is bridging, not routing. I've been assigned two static
> IPs (although they've given me a /24 net mask!!!) and my firewall is
> assigned one of them. The firewall is connected directly to the DSL modem
> by Cat6 patch cable. The other IP is unused (I use it for testing VPN
> configurations).
>
> I'm not sure but since the Broadxent Briteport is a PPPoE modem, I assume
> PPPoE. But the tech says that's not correct (WTF?). And he can't explain
> what they use. Sigh.
> --
> Reality Artisans, Inc.
> # Network Wrangling and Delousing
> P.O. Box 565, Gracie Station
> # Apple Certified Consultant
> New York, NY 10028-0019
> # Apple Consultants Network member
> <http://www.realityartisans.com>
> # Apple Developer Connection member
> Cell: [phone]
> # Ofc: [phone]
>
> On Jun 17, 2014, at 22:13 , Pedro Tumusok <pedro.tumusok-***@public.gmane.org> wrote:
>
>
> Well if the tech can see stuff, its not what I thought might be the
> problem, which was PVC settings.
>
> But does your modem get an IP address, ie is it setup as a router or does
> your computer get the ip address?
> Are you using PPPoA/PPPoE etc?
>
>
> On Wed, Jun 18, 2014 at 5:52 AM, Frank Bulk <frnkblk-***@public.gmane.org> wrote:
>
> Some Comtrend modems can do a port mirror of the WAN (DSL) side.
>
> Frank
>
>
> -----Original Message-----
> From: wireshark-users-bounces-IZ8446WsY0/***@public.gmane.org
> [mailto:wireshark-users-bounces-IZ8446WsY0/***@public.gmane.org] On Behalf Of Kok-Yong Tan
> Sent: Tuesday, June 17, 2014 4:53 PM
> To: Community support list for Wireshark
> Subject: Re: [Wireshark-users] Using Wireshark for a DSL "link no surf"
> problem
>
>
> > On Jun 17, 2014, at 14:28, Jaap Keuter <jaap.keuter-qWit8jRvyhVmR6Xm/***@public.gmane.org> wrote:
> >
> >> On 06/17/2014 08:42 PM, Kok-Yong Tan wrote:
> >> Is it possible to use Wireshark to troubleshoot a DSL "link no surf"
> problem? The ISP insists it's a CPE issue but the problem only started
> after their Tier 1 tech monkeyed with the DSLAM and/or the CPE (remotely)
> in
> some manner. I find it suspicious that the problem was intermittent packet
> loss until they tinkered, whereupon the problem became a "link no surf"
> issue (i.e., there's Layer 2 connectivity but zero Layer 3 traffic
> passing).
> >
> > Depends on what you can trace in the CPE, as in, how close to the DSL
> interface.
> > Otherwise you'll need capture hardware on the DSL....
> >
> > Good luck,
> > Jaap
> >
>
> I can get up to the DSL modem itself. In hindsight, I'm thinking this
> isn't
> going to be of much use and the only way to debug this is with capture
> hardware on the DSL side as you suggested. Drat.
> --
> Sent from my iPad2 with greater chance of typographical, grammatical and
> other disasters. Your indulgence is even more humbly requested.
> ___________________________________________________________________________
> Sent via: Wireshark-users mailing list <wireshark-users-IZ8446WsY0/***@public.gmane.org>
> Archives: http://www.wireshark.org/lists/wireshark-users
> Unsubscribe:https://wireshark.org/mailman/options/wireshark-users
> mailto:wireshark-users-request-IZ8446WsY0/***@public.gmane.org
> ?subject=unsubscribe
>
>
>
>
>
> --
> Best regards / Mvh
> Jan Pedro Tumusok
> ___________________________________________________________________________
> Sent via: Wireshark-users mailing list <wireshark-users-IZ8446WsY0/***@public.gmane.org>
> Archives: http://www.wireshark.org/lists/wireshark-users
> Unsubscribe:https://wireshark.org/mailman/options/wireshark-users
>
> mailto:wireshark-users-request-IZ8446WsY0/***@public.gmane.org?subject=unsubscribe
> <wireshark-users-request-IZ8446WsY0/***@public.gmane.org?subject=unsubscribe>
>
>
>
> ___________________________________________________________________________
> Sent via: Wireshark-users mailing list <wireshark-users-IZ8446WsY0/***@public.gmane.org>
> Archives: http://www.wireshark.org/lists/wireshark-users
> Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
>
> mailto:wireshark-users-request-IZ8446WsY0/***@public.gmane.org?subject=unsubscribe
> <wireshark-users-request-IZ8446WsY0/***@public.gmane.org?subject=unsubscribe>
>
> ___________________________________________________________________________
> Sent via: Wireshark-users mailing list <wireshark-users-IZ8446WsY0/***@public.gmane.org>
> Archives: http://www.wireshark.org/lists/wireshark-users
> Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
>
> mailto:wireshark-users-request-IZ8446WsY0/***@public.gmane.org?subject=unsubscribe
> <wireshark-users-request-IZ8446WsY0/***@public.gmane.org?subject=unsubscribe>
>
>
> ___________________________________________________________________________
> Sent via: Wireshark-users mailing list <wireshark-users-IZ8446WsY0/***@public.gmane.org>
> Archives: http://www.wireshark.org/lists/wireshark-users
> Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
>
> mailto:wireshark-users-request-IZ8446WsY0/***@public.gmane.org?subject=unsubscribe
> <wireshark-users-request-IZ8446WsY0/***@public.gmane.org?subject=unsubscribe>
>
>
>
> ___________________________________________________________________________
> Sent via: Wireshark-users mailing list <wireshark-users-IZ8446WsY0/***@public.gmane.org>
> Archives: http://www.wireshark.org/lists/wireshark-users
> Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
> mailto:wireshark-users-request-IZ8446WsY0/***@public.gmane.org
> ?subject=unsubscribe
>

[Kok-Yong Tan]

Just wanted to update the community on my problem (which has been
resolved). It had nothing to do with PPPoE after all. It seems that my
ISP, Megaputz/Megapath, changed the VPI/VCI numbers for my circuit from
0/35 (the default) to 0/40 and had set my DSL modem remotely. I suspect
that Tier 1 tech support foolishly remotely reset my DSL modem to
defaults without taking into consideration the VPI/VCI settings, thus
completely knocking me offline. When Megaputz sent out a tech with a
new DSL modem because the ISP's tech support Tier 1, Tier 2, NOC
Operations Team and Network Engineer all insisted it was due to "CPE
failure" (despite having sent them screenshots of the Broadxent/Innoband
DSL modem's setup screens where the VPI/VCI settings were prominently
displayed), he also couldn't connect until he noticed that the VPI/VCI
was set to 0/40 instead of the new modem's 0/35 (it seems 0/35 is the
factory default for most modems since the new and the old modem were
from different manufacturers--ZyXEL versus Broadxent/Innoband,
respectively). Once he set the VPI/VCI settings to 0/40 to match the
circuit (I watched him like a hawk and he changed nothing else), I was
back up instantly. Examining the setup screens of the old
Broadxent/Innoband modem which Megaputz claimed to be defective, I
noticed that its VPI/VCI was also set to 0/35. Since I had no admin
passwords, that is not something I could have set or reset. And I
didn't reset it to defaults myself.

This segues to my next question: Is there any way to use Wireshark to
ascertain the VPI/VCI of the ATM circuit from the Layer 2 packets that
were said to have been flowing? Or must I have specialized software or
hardware to do this? I noticed that the rep had nothing more than his
laptop connected via ethernet cable to the DSL modem when he noticed the
different VPI/VCI settings on a possibly in-house-only software running
on it.

On 6/19/14 03:36, Martin Visser wrote:
> There seems to be a lot of contradicting answers on this thread. PPPoE
> is used for authentication AND link negotiation (ie providing IP
> addresses) AND encapsulation. If you have a PPPoE modem in passthrough
> (which is what it sounds you are doing), the modem is just pretty much
> doing physical level translation between your DSL and Ethernet, and then
> your router (normally) is establish the PPPoE session. If you aren't
> able to capture traffic at the router and/or want to test locally you
> can use a PPPoE client on a laptop, for instance, and which also can run
> wireshark. Not sure what you have a available, but if you plug your
> Windows laptop into your modem directly, and then run through the
> Internet connection wizard (as per the example here -
> http://www.tp-link.com.au/article/?faqid=339 ) while running Wireshark
> you may have a better clue as to what is going on (or not).
>
>
> Regards, Martin
>
> MartinVisser99-***@public.gmane.org <mailto:MartinVisser99-***@public.gmane.org>
>
>
> On 19 June 2014 16:14, Kok-Yong Tan <ktan-Utl/FKD7rXpskJ3/***@public.gmane.org
> <mailto:ktan-Utl/FKD7rXpskJ3/***@public.gmane.org>> wrote:
>
> The service provider doesn't use DHCP to hand out my static IPs. I
> was assigned them via an email. The DHCP server is on the DSL modem
> (not the DSLAM) and it hands out a single IP address in the
> 192.168.1.0/24 <http://192.168.1.0/24> private range, namely
> 192.168.1.10. This is known as out-of-band management and only used
> for accessing the DSL modem itself and nothing else. The actual
> static addresses I'm assigned are in the public range while my DSL
> modem is supposedly set to bridging mode, i.e., it's not in the
> 10.0.0.0/8 <http://10.0.0.0/8>, 172.16.0.0/12 <http://172.16.0.0/12>
> or 192.168.0.0/16 <http://192.168.0.0/16> ranges.
>
> --
> Reality Artisans, Inc. # Network Wrangling and Delousing
> P.O. Box 565, Gracie Station # Apple Certified Consultant
> New York, NY 10028-0019 # Apple Consultants Network member
> <http://www.realityartisans.com <http://www.realityartisans.com/>>#
> Apple Developer Connection member
> Cell: [phone]# Ofc: [phone]
>
> On Jun 18, 2014, at 21:02 , Frank Bulk <frnkblk-***@public.gmane.org
> <mailto:frnkblk-***@public.gmane.org>> wrote:
>
>> If your service provider uses DHCP to hand out those “static” IPs,
>> or their access gear allows that IP address to be entered (which
>> is the case with our vendor’s gear), the access gear prevents
>> someone else taking your static IP.____
>> Frank____
>> *From:*wireshark-users-bounces-IZ8446WsY0/***@public.gmane.org
>> <mailto:wireshark-users-bounces-IZ8446WsY0/***@public.gmane.org> [mailto:wireshark-
>> <mailto:wireshark->users-bounces-IZ8446WsY0/***@public.gmane.org
>> <mailto:users-bounces-IZ8446WsY0/***@public.gmane.org>]*On Behalf Of*Kok-Yong Tan
>> *Sent:*Wednesday, June 18, 2014 1:58 PM
>> *To:*Community support list for Wireshark
>> *Subject:*Re: [Wireshark-users] Using Wireshark for a DSL "link no
>> surf" problem____
>> __ __
>> Yes, I understand why they gave me a /24 but with a /24, all it
>> takes is for somebody else on the same subnet to accidentally (not
>> intentionally or maliciously for obvious reasons) take my static
>> IP and thus blow me out of the water without affecting them too
>> much. I had this happen once. With a subnet between /24 and /30,
>> they'd notice when their accidentally typo-ed IP address didn't
>> work because it didn't match their gateway info. ____
>> -- ____
>> Reality Artisans, Inc. # Network Wrangling and Delousing
>> P.O. Box 565, Gracie Station # Apple Certified Consultant
>> New York, NY 10028-0019 # Apple Consultants Network member
>> <http://www.realityartisans.com
>> <http://www.realityartisans.com/>># Apple Developer Connection
>> member____
>> Cell: [phone]# Ofc: [phone]____
>> __ __
>> On Jun 18, 2014, at 10:59 , "Jamie O. Montgomery"
>> <Jamie.Montgomery-***@public.gmane.org
>> <mailto:Jamie.Montgomery-***@public.gmane.org>> wrote:____
>>
>>
>> ____
>>
>> PPPoE is used for authentication. If you have a static IP,
>> they know who has it and you don't need authentication. PPPoE
>> would be the termination point for the address, but since it
>> will reside on your firewall, the modem needs to bridge the
>> dsl network to the Ethernet network on the public side if the
>> firewall____
>> __ __
>>
>> They give you a /24 because they'd be burning up more IPv4
>> addresses giving you a smaller subnet. Other static IP
>> customers use addresses in that subnet along with you. ____
>>
>> *Jamie Montgomery | Comporium*____
>>
>> Network Facilities Engineering | Engineering Associate II____
>>
>> www.comporium.com <http://www.comporium.com/>____
>>
>> jamie.montgomery-***@public.gmane.org
>> <mailto:jamie.montgomery-***@public.gmane.org>____
>>
>>
>>
>> ____
>>
>> /The information contained in this e-mail message and any
>> attachments thereto are confidential, privileged, or otherwise
>> protected from disclosure, and are intended for the use of the
>> individual or entity named above. Dissemination, distribution
>> or copying of this message and any attachments by anyone other
>> than the intended recipient, or an employee or agent
>> responsible for delivering the message to the intended
>> recipient, is prohibited. If you have received this
>> communication in error, please immediately notify the sender
>> by telephone or e-mail and destroy the original message,
>> attachments, and all copies./____
>>
>>
>> On Jun 18, 2014, at 1:34 PM, "Kok-Yong Tan"
>> <ktan-Utl/FKD7rXpskJ3/***@public.gmane.org <mailto:ktan-Utl/FKD7rXpskJ3/***@public.gmane.org>>
>> wrote:____
>>
>> No, the DSL modem is bridging, not routing. I've been
>> assigned two static IPs (although they've given me a /24
>> net mask!!!) and my firewall is assigned one of them. The
>> firewall is connected directly to the DSL modem by Cat6
>> patch cable. The other IP is unused (I use it for testing
>> VPN configurations).____
>> __ __
>> I'm not sure but since the Broadxent Briteport is a PPPoE
>> modem, I assume PPPoE. But the tech says that's not
>> correct (WTF?). And he can't explain what they use.
>> Sigh.____
>> -- ____
>> Reality Artisans, Inc. ____
>> # Network Wrangling and Delousing
>> P.O. Box 565, Gracie Station ____
>> # Apple Certified Consultant
>> New York, NY 10028-0019 ____
>> # Apple Consultants Network member
>> <http://www.realityartisans.com
>> <http://www.realityartisans.com/>>____
>> # Apple Developer Connection member____
>> Cell: [phone]____
>> # Ofc: [phone]____
>> __ __
>> On Jun 17, 2014, at 22:13 , Pedro Tumusok
>> <pedro.tumusok-***@public.gmane.org <mailto:pedro.tumusok-***@public.gmane.org>>
>> wrote:____
>>
>>
>> ____
>>
>> Well if the tech can see stuff, its not what I thought
>> might be the problem, which was PVC settings.____
>> __ __
>> But does your modem get an IP address, ie is it setup
>> as a router or does your computer get the ip address?____
>> Are you using PPPoA/PPPoE etc?____
>>
>> __ __
>>
>> On Wed, Jun 18, 2014 at 5:52 AM, Frank Bulk
>> <frnkblk-***@public.gmane.org <mailto:frnkblk-***@public.gmane.org>> wrote:____
>>
>> Some Comtrend modems can do a port mirror of the
>> WAN (DSL) side.
>>
>> Frank____
>>
>>
>> -----Original Message-----
>> From:wireshark-users-bounces-IZ8446WsY0/***@public.gmane.org
>> <mailto:wireshark-users-bounces-IZ8446WsY0/***@public.gmane.org>
>> [mailto:wireshark-users-bounces-IZ8446WsY0/***@public.gmane.org
>> <mailto:wireshark-users-bounces-IZ8446WsY0/***@public.gmane.org>] On
>> Behalf Of Kok-Yong Tan
>> Sent: Tuesday, June 17, 2014 4:53 PM
>> To: Community support list for Wireshark
>> Subject: Re: [Wireshark-users] Using Wireshark for
>> a DSL "link no surf"
>> problem
>>
>>
>> > On Jun 17, 2014, at 14:28, Jaap Keuter
>> <jaap.keuter-qWit8jRvyhVmR6Xm/***@public.gmane.org
>> <mailto:jaap.keuter-qWit8jRvyhVmR6Xm/***@public.gmane.org>> wrote:
>> >
>> >> On 06/17/2014 08:42 PM, Kok-Yong Tan wrote:
>> >> Is it possible to use Wireshark to troubleshoot
>> a DSL "link no surf"
>> problem? The ISP insists it's a CPE issue but the
>> problem only started
>> after their Tier 1 tech monkeyed with the DSLAM
>> and/or the CPE (remotely) in
>> some manner. I find it suspicious that the
>> problem was intermittent packet
>> loss until they tinkered, whereupon the problem
>> became a "link no surf"
>> issue (i.e., there's Layer 2 connectivity but zero
>> Layer 3 traffic passing).
>> >
>> > Depends on what you can trace in the CPE, as in,
>> how close to the DSL
>> interface.
>> > Otherwise you'll need capture hardware on the
>> DSL....
>> >
>> > Good luck,
>> > Jaap
>> >
>>
>> I can get up to the DSL modem itself. In
>> hindsight, I'm thinking this isn't
>> going to be of much use and the only way to debug
>> this is with capture
>> hardware on the DSL side as you suggested. Drat.

[Guy Harris]

On Jul 2, 2014, at 3:46 PM, Kok-Yong Tan <ktan-Utl/FKD7rXpskJ3/***@public.gmane.org> wrote:

> This segues to my next question: Is there any way to use Wireshark to ascertain the VPI/VCI of the ATM circuit from the Layer 2 packets that were said to have been flowing? Or must I have specialized software or hardware to do this?

If you're capturing on the Ethernet into the modem, I wouldn't expect to see any ATM information from the capture - if, for example, the modem has an HTTP-based configuration interface for use on the local user side, Ethernet traffic to and from its Web server won't even necessarily go out over the DSL circuit.

To capture traffic on the ATM side of the modem, you'd need specialized hardware, and probably some level of specialized software to talk to that hardware.

> I noticed that the rep had nothing more than his laptop connected via ethernet cable to the DSL modem when he noticed the different VPI/VCI settings on a possibly in-house-only software running on it.

According to the manual for your modem at the URL you sent in an earlier message, there's an HTTP-based configuration interface. That's probably what the rep was using.
___________________________________________________________________________
Sent via: Wireshark-users mailing list <wireshark-users-IZ8446WsY0/***@public.gmane.org>
Archives: http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
mailto:wireshark-users-request-IZ8446WsY0/***@public.gmane.org?subject=unsubscribe

[Kok-Yong Tan]

On 7/2/14 19:31, Guy Harris wrote:
>
> On Jul 2, 2014, at 3:46 PM, Kok-Yong Tan <ktan-Utl/FKD7rXpskJ3/***@public.gmane.org>
> wrote:
>
>> This segues to my next question: Is there any way to use Wireshark
>> to ascertain the VPI/VCI of the ATM circuit from the Layer 2
>> packets that were said to have been flowing? Or must I have
>> specialized software or hardware to do this?
>
> If you're capturing on the Ethernet into the modem, I wouldn't expect
> to see any ATM information from the capture - if, for example, the
> modem has an HTTP-based configuration interface for use on the local
> user side, Ethernet traffic to and from its Web server won't even
> necessarily go out over the DSL circuit.
>
> To capture traffic on the ATM side of the modem, you'd need
> specialized hardware, and probably some level of specialized software
> to talk to that hardware.
>
>> I noticed that the rep had nothing more than his laptop connected
>> via ethernet cable to the DSL modem when he noticed the different
>> VPI/VCI settings on a possibly in-house-only software running on
>> it.
>
> According to the manual for your modem at the URL you sent in an
> earlier message, there's an HTTP-based configuration interface.
> That's probably what the rep was using.
>

Okay, noted on the ATM info. Thanks.

Unfortunately, he wasn't using that HTTP-based interface (I looked at
what he was looking at and it's not the Broadxent Briteport's
interface). The Broadxent Briteport's web-based interface is just a
status interface. There's nothing that can be set on it except for the
PPPoE settings and there's also a reset-to-defaults button. All through
the case when I was offline, it just displayed a VPI/VCI of 0/35. I
suspect that there is another port which allows an admin user to login
and manipulate the settings, just like on the replacement ZyXEL P660R-F1
the onsite tech provided me with.

[Frank Bulk (iname.com)]

Some DSL modems do have an auto-detect where they cycle through the most
common VPI/VCI values.

Frank

-----Original Message-----
From: wireshark-users-bounces-IZ8446WsY0/***@public.gmane.org
[mailto:wireshark-users-bounces-IZ8446WsY0/***@public.gmane.org] On Behalf Of Kok-Yong Tan
Sent: Wednesday, July 02, 2014 7:09 PM
To: Guy Harris; Community support list for Wireshark
Subject: Re: [Wireshark-users] Using Wireshark for a DSL "link no surf"
problem [UPDATE]

On 7/2/14 19:31, Guy Harris wrote:
>
> On Jul 2, 2014, at 3:46 PM, Kok-Yong Tan <ktan-Utl/FKD7rXpskJ3/***@public.gmane.org>
> wrote:
>
>> This segues to my next question: Is there any way to use Wireshark
>> to ascertain the VPI/VCI of the ATM circuit from the Layer 2
>> packets that were said to have been flowing? Or must I have
>> specialized software or hardware to do this?
>
> If you're capturing on the Ethernet into the modem, I wouldn't expect
> to see any ATM information from the capture - if, for example, the
> modem has an HTTP-based configuration interface for use on the local
> user side, Ethernet traffic to and from its Web server won't even
> necessarily go out over the DSL circuit.
>
> To capture traffic on the ATM side of the modem, you'd need
> specialized hardware, and probably some level of specialized software
> to talk to that hardware.
>
>> I noticed that the rep had nothing more than his laptop connected
>> via ethernet cable to the DSL modem when he noticed the different
>> VPI/VCI settings on a possibly in-house-only software running on
>> it.
>
> According to the manual for your modem at the URL you sent in an
> earlier message, there's an HTTP-based configuration interface.
> That's probably what the rep was using.
>

Okay, noted on the ATM info. Thanks.

Unfortunately, he wasn't using that HTTP-based interface (I looked at
what he was looking at and it's not the Broadxent Briteport's
interface). The Broadxent Briteport's web-based interface is just a
status interface. There's nothing that can be set on it except for the
PPPoE settings and there's also a reset-to-defaults button. All through
the case when I was offline, it just displayed a VPI/VCI of 0/35. I
suspect that there is another port which allows an admin user to login
and manipulate the settings, just like on the replacement ZyXEL P660R-F1
the onsite tech provided me with.


___________________________________________________________________________
Sent via: Wireshark-users mailing list <wireshark-users-IZ8446WsY0/***@public.gmane.org>
Archives: http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
mailto:wireshark-users-request-IZ8446WsY0/***@public.gmane.org?subject=unsubscribe

[Kok-Yong Tan]

Yes, well, the ZyXEL P660R-F1 and the Broadxent/Innoband Briteport
don't. If they did, I wouldn't have had any problems connecting up in
the first place. That's why I'm looking for a method/software/hardware
that would detect what the existing VPI/VCI is on the wire besides just
knowing what it was set to.

From what I gathered in reading "End-to-End DSL Architectures" by Wayne
C. Vermillion, VPI is the Virtual Path Identifier and VCI is the Virtual
Circuit Identifier. Also, for each ATM physical link, there are 256
possible VPIs and within each VP are 65,536 possible VCIs (less
identifier numbers 0-31 which are reserved). This means that there are
a humongous number of possible valid values of VPI/VCI (256 * 65,504 by
my calculation) to cycle through if one takes the brute force approach.
And even if one were to chance upon the correct set of values, how
does one verify that it's the intended one?

On 7/6/14 23:42, Frank Bulk (iname.com) wrote:
> Some DSL modems do have an auto-detect where they cycle through the most
> common VPI/VCI values.
>
> Frank
>
> -----Original Message-----
> From: wireshark-users-bounces-IZ8446WsY0/***@public.gmane.org
> [mailto:wireshark-users-bounces-IZ8446WsY0/***@public.gmane.org] On Behalf Of Kok-Yong Tan
> Sent: Wednesday, July 02, 2014 7:09 PM
> To: Guy Harris; Community support list for Wireshark
> Subject: Re: [Wireshark-users] Using Wireshark for a DSL "link no surf"
> problem [UPDATE]
>
> On 7/2/14 19:31, Guy Harris wrote:
>>
>> On Jul 2, 2014, at 3:46 PM, Kok-Yong Tan <ktan-Utl/FKD7rXpskJ3/***@public.gmane.org>
>> wrote:
>>
>>> This segues to my next question: Is there any way to use Wireshark
>>> to ascertain the VPI/VCI of the ATM circuit from the Layer 2
>>> packets that were said to have been flowing? Or must I have
>>> specialized software or hardware to do this?
>>
>> If you're capturing on the Ethernet into the modem, I wouldn't expect
>> to see any ATM information from the capture - if, for example, the
>> modem has an HTTP-based configuration interface for use on the local
>> user side, Ethernet traffic to and from its Web server won't even
>> necessarily go out over the DSL circuit.
>>
>> To capture traffic on the ATM side of the modem, you'd need
>> specialized hardware, and probably some level of specialized software
>> to talk to that hardware.
>>
>>> I noticed that the rep had nothing more than his laptop connected
>>> via ethernet cable to the DSL modem when he noticed the different
>>> VPI/VCI settings on a possibly in-house-only software running on
>>> it.
>>
>> According to the manual for your modem at the URL you sent in an
>> earlier message, there's an HTTP-based configuration interface.
>> That's probably what the rep was using.
>>
>
> Okay, noted on the ATM info. Thanks.
>
> Unfortunately, he wasn't using that HTTP-based interface (I looked at
> what he was looking at and it's not the Broadxent Briteport's
> interface). The Broadxent Briteport's web-based interface is just a
> status interface. There's nothing that can be set on it except for the
> PPPoE settings and there's also a reset-to-defaults button. All through
> the case when I was offline, it just displayed a VPI/VCI of 0/35. I
> suspect that there is another port which allows an admin user to login
> and manipulate the settings, just like on the replacement ZyXEL P660R-F1
> the onsite tech provided me with.
>
>

[Frank Bulk (iname.com)]

The most common values are 0/35 and 8/35 and 0/100
(http://www.dslreports.com/faq/1149). I'm sure there are a few more
variations. That auto-detect would quickly detect the most common ones.

Frank

-----Original Message-----
From: wireshark-users-bounces-IZ8446WsY0/***@public.gmane.org
[mailto:wireshark-users-bounces-IZ8446WsY0/***@public.gmane.org] On Behalf Of Kok-Yong Tan
Sent: Monday, July 07, 2014 7:06 PM
To: Community support list for Wireshark
Subject: Re: [Wireshark-users] Using Wireshark for a DSL "link no surf"
problem [UPDATE]

Yes, well, the ZyXEL P660R-F1 and the Broadxent/Innoband Briteport
don't. If they did, I wouldn't have had any problems connecting up in
the first place. That's why I'm looking for a method/software/hardware
that would detect what the existing VPI/VCI is on the wire besides just
knowing what it was set to.

From what I gathered in reading "End-to-End DSL Architectures" by Wayne
C. Vermillion, VPI is the Virtual Path Identifier and VCI is the Virtual
Circuit Identifier. Also, for each ATM physical link, there are 256
possible VPIs and within each VP are 65,536 possible VCIs (less
identifier numbers 0-31 which are reserved). This means that there are
a humongous number of possible valid values of VPI/VCI (256 * 65,504 by
my calculation) to cycle through if one takes the brute force approach.
And even if one were to chance upon the correct set of values, how
does one verify that it's the intended one?

On 7/6/14 23:42, Frank Bulk (iname.com) wrote:
> Some DSL modems do have an auto-detect where they cycle through the most
> common VPI/VCI values.
>
> Frank
>
> -----Original Message-----
> From: wireshark-users-bounces-IZ8446WsY0/***@public.gmane.org
> [mailto:wireshark-users-bounces-IZ8446WsY0/***@public.gmane.org] On Behalf Of Kok-Yong Tan
> Sent: Wednesday, July 02, 2014 7:09 PM
> To: Guy Harris; Community support list for Wireshark
> Subject: Re: [Wireshark-users] Using Wireshark for a DSL "link no surf"
> problem [UPDATE]
>
> On 7/2/14 19:31, Guy Harris wrote:
>>
>> On Jul 2, 2014, at 3:46 PM, Kok-Yong Tan <ktan-Utl/FKD7rXpskJ3/***@public.gmane.org>
>> wrote:
>>
>>> This segues to my next question: Is there any way to use Wireshark
>>> to ascertain the VPI/VCI of the ATM circuit from the Layer 2
>>> packets that were said to have been flowing? Or must I have
>>> specialized software or hardware to do this?
>>
>> If you're capturing on the Ethernet into the modem, I wouldn't expect
>> to see any ATM information from the capture - if, for example, the
>> modem has an HTTP-based configuration interface for use on the local
>> user side, Ethernet traffic to and from its Web server won't even
>> necessarily go out over the DSL circuit.
>>
>> To capture traffic on the ATM side of the modem, you'd need
>> specialized hardware, and probably some level of specialized software
>> to talk to that hardware.
>>
>>> I noticed that the rep had nothing more than his laptop connected
>>> via ethernet cable to the DSL modem when he noticed the different
>>> VPI/VCI settings on a possibly in-house-only software running on
>>> it.
>>
>> According to the manual for your modem at the URL you sent in an
>> earlier message, there's an HTTP-based configuration interface.
>> That's probably what the rep was using.
>>
>
> Okay, noted on the ATM info. Thanks.
>
> Unfortunately, he wasn't using that HTTP-based interface (I looked at
> what he was looking at and it's not the Broadxent Briteport's
> interface). The Broadxent Briteport's web-based interface is just a
> status interface. There's nothing that can be set on it except for the
> PPPoE settings and there's also a reset-to-defaults button. All through
> the case when I was offline, it just displayed a VPI/VCI of 0/35. I
> suspect that there is another port which allows an admin user to login
> and manipulate the settings, just like on the replacement ZyXEL P660R-F1
> the onsite tech provided me with.
>
>



___________________________________________________________________________
Sent via: Wireshark-users mailing list <wireshark-users-IZ8446WsY0/***@public.gmane.org>
Archives: http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
mailto:wireshark-users-request-IZ8446WsY0/***@public.gmane.org?subject=unsubscribe

[Kok-Yong Tan]

And since my ISP, MegaPutz/MegaPath uses 0/40 (which isn't listed
there), that "auto-detect" would never have found it. It's really not
an auto-detect if it just cycles through "the most common values" but
more of a brute force/trial-and-error approach.

On 7/11/14 09:59, Frank Bulk (iname.com) wrote:
> The most common values are 0/35 and 8/35 and 0/100
> (http://www.dslreports.com/faq/1149). I'm sure there are a few more
> variations. That auto-detect would quickly detect the most common ones.
>
> Frank
>
> -----Original Message-----
> From: wireshark-users-bounces-IZ8446WsY0/***@public.gmane.org
> [mailto:wireshark-users-bounces-IZ8446WsY0/***@public.gmane.org] On Behalf Of Kok-Yong Tan
> Sent: Monday, July 07, 2014 7:06 PM
> To: Community support list for Wireshark
> Subject: Re: [Wireshark-users] Using Wireshark for a DSL "link no surf"
> problem [UPDATE]
>
> Yes, well, the ZyXEL P660R-F1 and the Broadxent/Innoband Briteport
> don't. If they did, I wouldn't have had any problems connecting up in
> the first place. That's why I'm looking for a method/software/hardware
> that would detect what the existing VPI/VCI is on the wire besides just
> knowing what it was set to.
>
> From what I gathered in reading "End-to-End DSL Architectures" by Wayne
> C. Vermillion, VPI is the Virtual Path Identifier and VCI is the Virtual
> Circuit Identifier. Also, for each ATM physical link, there are 256
> possible VPIs and within each VP are 65,536 possible VCIs (less
> identifier numbers 0-31 which are reserved). This means that there are
> a humongous number of possible valid values of VPI/VCI (256 * 65,504 by
> my calculation) to cycle through if one takes the brute force approach.
> And even if one were to chance upon the correct set of values, how
> does one verify that it's the intended one?
>
> On 7/6/14 23:42, Frank Bulk (iname.com) wrote:
>> Some DSL modems do have an auto-detect where they cycle through the most
>> common VPI/VCI values.
>>
>> Frank
>>
>> -----Original Message-----
>> From: wireshark-users-bounces-IZ8446WsY0/***@public.gmane.org
>> [mailto:wireshark-users-bounces-IZ8446WsY0/***@public.gmane.org] On Behalf Of Kok-Yong Tan
>> Sent: Wednesday, July 02, 2014 7:09 PM
>> To: Guy Harris; Community support list for Wireshark
>> Subject: Re: [Wireshark-users] Using Wireshark for a DSL "link no surf"
>> problem [UPDATE]
>>
>> On 7/2/14 19:31, Guy Harris wrote:
>>>
>>> On Jul 2, 2014, at 3:46 PM, Kok-Yong Tan <ktan-Utl/FKD7rXpskJ3/***@public.gmane.org>
>>> wrote:
>>>
>>>> This segues to my next question: Is there any way to use Wireshark
>>>> to ascertain the VPI/VCI of the ATM circuit from the Layer 2
>>>> packets that were said to have been flowing? Or must I have
>>>> specialized software or hardware to do this?
>>>
>>> If you're capturing on the Ethernet into the modem, I wouldn't expect
>>> to see any ATM information from the capture - if, for example, the
>>> modem has an HTTP-based configuration interface for use on the local
>>> user side, Ethernet traffic to and from its Web server won't even
>>> necessarily go out over the DSL circuit.
>>>
>>> To capture traffic on the ATM side of the modem, you'd need
>>> specialized hardware, and probably some level of specialized software
>>> to talk to that hardware.
>>>
>>>> I noticed that the rep had nothing more than his laptop connected
>>>> via ethernet cable to the DSL modem when he noticed the different
>>>> VPI/VCI settings on a possibly in-house-only software running on
>>>> it.
>>>
>>> According to the manual for your modem at the URL you sent in an
>>> earlier message, there's an HTTP-based configuration interface.
>>> That's probably what the rep was using.
>>>
>>
>> Okay, noted on the ATM info. Thanks.
>>
>> Unfortunately, he wasn't using that HTTP-based interface (I looked at
>> what he was looking at and it's not the Broadxent Briteport's
>> interface). The Broadxent Briteport's web-based interface is just a
>> status interface. There's nothing that can be set on it except for the
>> PPPoE settings and there's also a reset-to-defaults button. All through
>> the case when I was offline, it just displayed a VPI/VCI of 0/35. I
>> suspect that there is another port which allows an admin user to login
>> and manipulate the settings, just like on the replacement ZyXEL P660R-F1
>> the onsite tech provided me with.
>>
>>
>
>
>

[Pedro Tumusok]

The auto-detect is usually geared towards the ISP, so they just submit at
list of vpi/vci settings they use, the vendor will include that in the list
pvc's that they try to use.

Not only do you need to setup for pvc, but also encapsulation ala
PPPoE/PPPoA,IP, Ethernet and so forth.

And most ZyXEL devices does have this feature, but its not exposed to the
end-users. If you got access to the cli of the ZyXEL device you can try to
poke at it with the following command.

wan adsl vchunt

But you still need to know what pvc's your ISP uses to create a list that
you will test.

Pedro


On Fri, Jul 11, 2014 at 4:31 PM, Kok-Yong Tan <ktan-Utl/FKD7rXpskJ3/***@public.gmane.org>
wrote:

> And since my ISP, MegaPutz/MegaPath uses 0/40 (which isn't listed there),
> that "auto-detect" would never have found it. It's really not an
> auto-detect if it just cycles through "the most common values" but more of
> a brute force/trial-and-error approach.
>
>
> On 7/11/14 09:59, Frank Bulk (iname.com) wrote:
>
>> The most common values are 0/35 and 8/35 and 0/100
>> (http://www.dslreports.com/faq/1149). I'm sure there are a few more
>> variations. That auto-detect would quickly detect the most common ones.
>>
>> Frank
>>
>> -----Original Message-----
>> From: wireshark-users-bounces-IZ8446WsY0/***@public.gmane.org
>> [mailto:wireshark-users-bounces-IZ8446WsY0/***@public.gmane.org] On Behalf Of Kok-Yong Tan
>> Sent: Monday, July 07, 2014 7:06 PM
>> To: Community support list for Wireshark
>> Subject: Re: [Wireshark-users] Using Wireshark for a DSL "link no surf"
>> problem [UPDATE]
>>
>> Yes, well, the ZyXEL P660R-F1 and the Broadxent/Innoband Briteport
>> don't. If they did, I wouldn't have had any problems connecting up in
>> the first place. That's why I'm looking for a method/software/hardware
>> that would detect what the existing VPI/VCI is on the wire besides just
>> knowing what it was set to.
>>
>> From what I gathered in reading "End-to-End DSL Architectures" by Wayne
>> C. Vermillion, VPI is the Virtual Path Identifier and VCI is the Virtual
>> Circuit Identifier. Also, for each ATM physical link, there are 256
>> possible VPIs and within each VP are 65,536 possible VCIs (less
>> identifier numbers 0-31 which are reserved). This means that there are
>> a humongous number of possible valid values of VPI/VCI (256 * 65,504 by
>> my calculation) to cycle through if one takes the brute force approach.
>> And even if one were to chance upon the correct set of values, how
>> does one verify that it's the intended one?
>>
>> On 7/6/14 23:42, Frank Bulk (iname.com) wrote:
>>
>>> Some DSL modems do have an auto-detect where they cycle through the most
>>> common VPI/VCI values.
>>>
>>> Frank
>>>
>>> -----Original Message-----
>>> From: wireshark-users-bounces-IZ8446WsY0/***@public.gmane.org
>>> [mailto:wireshark-users-bounces-IZ8446WsY0/***@public.gmane.org] On Behalf Of Kok-Yong Tan
>>> Sent: Wednesday, July 02, 2014 7:09 PM
>>> To: Guy Harris; Community support list for Wireshark
>>> Subject: Re: [Wireshark-users] Using Wireshark for a DSL "link no surf"
>>> problem [UPDATE]
>>>
>>> On 7/2/14 19:31, Guy Harris wrote:
>>>
>>>>
>>>> On Jul 2, 2014, at 3:46 PM, Kok-Yong Tan <ktan-Utl/FKD7rXpskJ3/***@public.gmane.org>
>>>> wrote:
>>>>
>>>> This segues to my next question: Is there any way to use Wireshark
>>>>> to ascertain the VPI/VCI of the ATM circuit from the Layer 2
>>>>> packets that were said to have been flowing? Or must I have
>>>>> specialized software or hardware to do this?
>>>>>
>>>>
>>>> If you're capturing on the Ethernet into the modem, I wouldn't expect
>>>> to see any ATM information from the capture - if, for example, the
>>>> modem has an HTTP-based configuration interface for use on the local
>>>> user side, Ethernet traffic to and from its Web server won't even
>>>> necessarily go out over the DSL circuit.
>>>>
>>>> To capture traffic on the ATM side of the modem, you'd need
>>>> specialized hardware, and probably some level of specialized software
>>>> to talk to that hardware.
>>>>
>>>> I noticed that the rep had nothing more than his laptop connected
>>>>> via ethernet cable to the DSL modem when he noticed the different
>>>>> VPI/VCI settings on a possibly in-house-only software running on
>>>>> it.
>>>>>
>>>>
>>>> According to the manual for your modem at the URL you sent in an
>>>> earlier message, there's an HTTP-based configuration interface.
>>>> That's probably what the rep was using.
>>>>
>>>>
>>> Okay, noted on the ATM info. Thanks.
>>>
>>> Unfortunately, he wasn't using that HTTP-based interface (I looked at
>>> what he was looking at and it's not the Broadxent Briteport's
>>> interface). The Broadxent Briteport's web-based interface is just a
>>> status interface. There's nothing that can be set on it except for the
>>> PPPoE settings and there's also a reset-to-defaults button. All through
>>> the case when I was offline, it just displayed a VPI/VCI of 0/35. I
>>> suspect that there is another port which allows an admin user to login
>>> and manipulate the settings, just like on the replacement ZyXEL P660R-F1
>>> the onsite tech provided me with.
>>>
>>>
>>>
>>
>>
>>
>
>
> ___________________________________________________________________________
> Sent via: Wireshark-users mailing list <wireshark-users-IZ8446WsY0/***@public.gmane.org>
> Archives: http://www.wireshark.org/lists/wireshark-users
> Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
> mailto:wireshark-users-request-IZ8446WsY0/***@public.gmane.org
> ?subject=unsubscribe
>



--
Best regards / Mvh
Jan Pedro Tumusok

[Aaron Wasserott]

Some ISPs will still use PPP even though you have static assignments. This gives them an easy way to lock accounts for non-payment in their RADIUS server, instead of having to shut down the PVC or DSLAM interface.

From: wireshark-users-bounces-IZ8446WsY0/***@public.gmane.org [mailto:wireshark-users-***@wireshark.org] On Behalf Of Jamie O. Montgomery
Sent: Wednesday, June 18, 2014 11:59 AM
To: Community support list for Wireshark
Subject: Re: [Wireshark-users] Using Wireshark for a DSL "link no surf" problem

PPPoE is used for authentication. If you have a static IP, they know who has it and you don't need authentication. PPPoE would be the termination point for the address, but since it will reside on your firewall, the modem needs to bridge the dsl network to the Ethernet network on the public side if the firewall

They give you a /24 because they'd be burning up more IPv4 addresses giving you a smaller subnet. Other static IP customers use addresses in that subnet along with you.
Jamie Montgomery | Comporium
Network Facilities Engineering | Engineering Associate II
www.comporium.com<http://www.comporium.com/>
jamie.montgomery-***@public.gmane.org<mailto:jamie.montgomery-***@public.gmane.org>


The information contained in this e-mail message and any attachments thereto are confidential, privileged, or otherwise protected from disclosure, and are intended for the use of the individual or entity named above. Dissemination, distribution or copying of this message and any attachments by anyone other than the intended recipient, or an employee or agent responsible for delivering the message to the intended recipient, is prohibited. If you have received this communication in error, please immediately notify the sender by telephone or e-mail and destroy the original message, attachments, and all copies.

On Jun 18, 2014, at 1:34 PM, "Kok-Yong Tan" <ktan-Utl/FKD7rXpskJ3/***@public.gmane.org<mailto:ktan-Utl/FKD7rXpskJ3/***@public.gmane.org>> wrote:
No, the DSL modem is bridging, not routing. I've been assigned two static IPs (although they've given me a /24 net mask!!!) and my firewall is assigned one of them. The firewall is connected directly to the DSL modem by Cat6 patch cable. The other IP is unused (I use it for testing VPN configurations).

I'm not sure but since the Broadxent Briteport is a PPPoE modem, I assume PPPoE. But the tech says that's not correct (WTF?). And he can't explain what they use. Sigh.
--
Reality Artisans, Inc.
# Network Wrangling and Delousing
P.O. Box 565, Gracie Station
# Apple Certified Consultant
New York, NY 10028-0019
# Apple Consultants Network member
<http://www.realityartisans.com<http://www.realityartisans.com/>>
# Apple Developer Connection member
Cell: [phone]
# Ofc: [phone]

On Jun 17, 2014, at 22:13 , Pedro Tumusok <pedro.tumusok-***@public.gmane.org<mailto:pedro.tumusok-***@public.gmane.org>> wrote:


Well if the tech can see stuff, its not what I thought might be the problem, which was PVC settings.

But does your modem get an IP address, ie is it setup as a router or does your computer get the ip address?
Are you using PPPoA/PPPoE etc?

On Wed, Jun 18, 2014 at 5:52 AM, Frank Bulk <frnkblk-***@public.gmane.org<mailto:frnkblk-***@public.gmane.org>> wrote:
Some Comtrend modems can do a port mirror of the WAN (DSL) side.

Frank

-----Original Message-----
From: wireshark-users-bounces-IZ8446WsY0/***@public.gmane.org<mailto:wireshark-users-***@wireshark.org>
[mailto:wireshark-users-bounces-IZ8446WsY0/***@public.gmane.org<mailto:wireshark-users-***@wireshark.org>] On Behalf Of Kok-Yong Tan
Sent: Tuesday, June 17, 2014 4:53 PM
To: Community support list for Wireshark
Subject: Re: [Wireshark-users] Using Wireshark for a DSL "link no surf"
problem


> On Jun 17, 2014, at 14:28, Jaap Keuter <jaap.keuter-qWit8jRvyhVmR6Xm/***@public.gmane.org<mailto:jaap.keuter-qWit8jRvyhVmR6Xm/***@public.gmane.org>> wrote:
>
>> On 06/17/2014 08:42 PM, Kok-Yong Tan wrote:
>> Is it possible to use Wireshark to troubleshoot a DSL "link no surf"
problem? The ISP insists it's a CPE issue but the problem only started
after their Tier 1 tech monkeyed with the DSLAM and/or the CPE (remotely) in
some manner. I find it suspicious that the problem was intermittent packet
loss until they tinkered, whereupon the problem became a "link no surf"
issue (i.e., there's Layer 2 connectivity but zero Layer 3 traffic passing).
>
> Depends on what you can trace in the CPE, as in, how close to the DSL
interface.
> Otherwise you'll need capture hardware on the DSL....
>
> Good luck,
> Jaap
>

I can get up to the DSL modem itself. In hindsight, I'm thinking this isn't
going to be of much use and the only way to debug this is with capture
hardware on the DSL side as you suggested. Drat.
--
Sent from my iPad2 with greater chance of typographical, grammatical and
other disasters. Your indulgence is even more humbly requested.
___________________________________________________________________________
Sent via: Wireshark-users mailing list <wireshark-users-IZ8446WsY0/***@public.gmane.org<mailto:wireshark-users-IZ8446WsY0/***@public.gmane.org>>
Archives: http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
mailto:wireshark-users-request-IZ8446WsY0/***@public.gmane.org<mailto:wireshark-users-request-IZ8446WsY0/***@public.gmane.org>?subject=unsubscribe



--
Best regards / Mvh
Jan Pedro Tumusok
___________________________________________________________________________
Sent via: Wireshark-users mailing list <wireshark-users-IZ8446WsY0/***@public.gmane.org<mailto:wireshark-users-IZ8446WsY0/***@public.gmane.org>>
Archives: http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
mailto:wireshark-users-request-IZ8446WsY0/***@public.gmane.org?subject=unsubscribe

___________________________________________________________________________
Sent via: Wireshark-users mailing list <wireshark-users-IZ8446WsY0/***@public.gmane.org<mailto:wireshark-users-IZ8446WsY0/***@public.gmane.org>>
Archives: http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
mailto:wireshark-users-request-IZ8446WsY0/***@public.gmane.org?subject=unsubscribe

[Kok-Yong Tan]

This is what I'm suspecting (that the first Tier 1 tech accidentally killed my credentials either on the DSL modem or at their RADIUS server or even accidentally shutting down the PVC or DSLAM interface). The ISP (MegaPath/MegaPutz) has a nasty habit of "accidentally" administratively disabling circuits. I once used to be a reseller for them until they "accidentally" administratively disabled a circuit of a client that was fully paid up. They denied it for an entire month until I found a helpful tech support rep at random who was willing to check it out for me and then within 20 seconds, the circuit came back up. I called up their accounting department about reimbursement for the month of no service for the client and they dodged me. I'm currently stuck with them because I need to be using DSL (I can't use cable due to location issues) and the alternative DSL provider in my area (Verizon) is worse (bad experiences with them also).
--
Reality Artisans, Inc. # Network Wrangling and Delousing
P.O. Box 565, Gracie Station # Apple Certified Consultant
New York, NY 10028-0019 # Apple Consultants Network member
<http://www.realityartisans.com> # Apple Developer Connection member
Cell: [phone] # Ofc: [phone]

On Jun 18, 2014, at 11:15 , Aaron Wasserott <aaron.wasserott-b+YE/***@public.gmane.org> wrote:

> Some ISPs will still use PPP even though you have static assignments. This gives them an easy way to lock accounts for non-payment in their RADIUS server, instead of having to shut down the PVC or DSLAM interface.
>
> From: wireshark-users-bounces-IZ8446WsY0/***@public.gmane.org [mailto:wireshark-users-bounces-IZ8446WsY0/***@public.gmane.org]On Behalf Of Jamie O. Montgomery
> Sent: Wednesday, June 18, 2014 11:59 AM
> To: Community support list for Wireshark
> Subject: Re: [Wireshark-users] Using Wireshark for a DSL "link no surf" problem
>
> PPPoE is used for authentication. If you have a static IP, they know who has it and you don't need authentication. PPPoE would be the termination point for the address, but since it will reside on your firewall, the modem needs to bridge the dsl network to the Ethernet network on the public side if the firewall
>
> They give you a /24 because they'd be burning up more IPv4 addresses giving you a smaller subnet. Other static IP customers use addresses in that subnet along with you.
>
> Jamie Montgomery | Comporium
>
> Network Facilities Engineering | Engineering Associate II
>
> www.comporium.com
>
> jamie.montgomery-***@public.gmane.org
>
>
>
>
> The information contained in this e-mail message and any attachments thereto are confidential, privileged, or otherwise protected from disclosure, and are intended for the use of the individual or entity named above. Dissemination, distribution or copying of this message and any attachments by anyone other than the intended recipient, or an employee or agent responsible for delivering the message to the intended recipient, is prohibited. If you have received this communication in error, please immediately notify the sender by telephone or e-mail and destroy the original message, attachments, and all copies.
>
>
> On Jun 18, 2014, at 1:34 PM, "Kok-Yong Tan" <ktan-Utl/FKD7rXpskJ3/***@public.gmane.org> wrote:
>
> No, the DSL modem is bridging, not routing. I've been assigned two static IPs (although they've given me a /24 net mask!!!) and my firewall is assigned one of them. The firewall is connected directly to the DSL modem by Cat6 patch cable. The other IP is unused (I use it for testing VPN configurations).
>
> I'm not sure but since the Broadxent Briteport is a PPPoE modem, I assume PPPoE. But the tech says that's not correct (WTF?). And he can't explain what they use. Sigh.
> --
> Reality Artisans, Inc.
> # Network Wrangling and Delousing
> P.O. Box 565, Gracie Station
> # Apple Certified Consultant
> New York, NY 10028-0019
> # Apple Consultants Network member
> <http://www.realityartisans.com>
> # Apple Developer Connection member
> Cell: [phone]
> # Ofc: [phone]
>
> On Jun 17, 2014, at 22:13 , Pedro Tumusok <pedro.tumusok-***@public.gmane.org> wrote:
>
>
> Well if the tech can see stuff, its not what I thought might be the problem, which was PVC settings.
>
> But does your modem get an IP address, ie is it setup as a router or does your computer get the ip address?
> Are you using PPPoA/PPPoE etc?
>
>
> On Wed, Jun 18, 2014 at 5:52 AM, Frank Bulk <frnkblk-***@public.gmane.org> wrote:
> Some Comtrend modems can do a port mirror of the WAN (DSL) side.
>
> Frank
>
> -----Original Message-----
> From: wireshark-users-bounces-IZ8446WsY0/***@public.gmane.org
> [mailto:wireshark-users-bounces-IZ8446WsY0/***@public.gmane.org] On Behalf Of Kok-Yong Tan
> Sent: Tuesday, June 17, 2014 4:53 PM
> To: Community support list for Wireshark
> Subject: Re: [Wireshark-users] Using Wireshark for a DSL "link no surf"
> problem
>
>
> > On Jun 17, 2014, at 14:28, Jaap Keuter <jaap.keuter-qWit8jRvyhVmR6Xm/***@public.gmane.org> wrote:
> >
> >> On 06/17/2014 08:42 PM, Kok-Yong Tan wrote:
> >> Is it possible to use Wireshark to troubleshoot a DSL "link no surf"
> problem? The ISP insists it's a CPE issue but the problem only started
> after their Tier 1 tech monkeyed with the DSLAM and/or the CPE (remotely) in
> some manner. I find it suspicious that the problem was intermittent packet
> loss until they tinkered, whereupon the problem became a "link no surf"
> issue (i.e., there's Layer 2 connectivity but zero Layer 3 traffic passing).
> >
> > Depends on what you can trace in the CPE, as in, how close to the DSL
> interface.
> > Otherwise you'll need capture hardware on the DSL....
> >
> > Good luck,
> > Jaap
> >
>
> I can get up to the DSL modem itself. In hindsight, I'm thinking this isn't
> going to be of much use and the only way to debug this is with capture
> hardware on the DSL side as you suggested. Drat.
> --
> Sent from my iPad2 with greater chance of typographical, grammatical and
> other disasters. Your indulgence is even more humbly requested.
>
> ___________________________________________________________________________
> Sent via: Wireshark-users mailing list <wireshark-users-IZ8446WsY0/***@public.gmane.org>
> Archives: http://www.wireshark.org/lists/wireshark-users
> Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
> mailto:wireshark-users-request-IZ8446WsY0/***@public.gmane.org?subject=unsubscribe
>
>
>
> --
> Best regards / Mvh
> Jan Pedro Tumusok
>
> ___________________________________________________________________________
> Sent via: Wireshark-users mailing list <wireshark-users-IZ8446WsY0/***@public.gmane.org>
> Archives: http://www.wireshark.org/lists/wireshark-users
> Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
> mailto:wireshark-users-request-IZ8446WsY0/***@public.gmane.org?subject=unsubscribe
>
> ___________________________________________________________________________
> Sent via: Wireshark-users mailing list <wireshark-users-IZ8446WsY0/***@public.gmane.org>
> Archives: http://www.wireshark.org/lists/wireshark-users
> Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
> mailto:wireshark-users-request-IZ8446WsY0/***@public.gmane.org?subject=unsubscribe
> ___________________________________________________________________________
> Sent via: Wireshark-users mailing list <wireshark-users-IZ8446WsY0/***@public.gmane.org>
> Archives: http://www.wireshark.org/lists/wireshark-users
> Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
> mailto:wireshark-users-request-IZ8446WsY0/***@public.gmane.org?subject=unsubscribe

[Jamie O. Montgomery]

True. With the two types of DSLAMs we have we either associate the static IP with the port or the mac address of the CPE. The IP wouldn't work anywhere else.

Jamie Montgomery | Comporium
Network Facilities Engineering | Engineering Associate II
www.comporium.com
jamie.montgomery-***@public.gmane.org

The information contained in this e-mail message and any attachments thereto are confidential, privileged, or otherwise protected from disclosure, and are intended for the use of the individual or entity named above. Dissemination, distribution or copying of this message and any attachments by anyone other than the intended recipient, or an employee or agent responsible for delivering the message to the intended recipient, is prohibited. If you have received this communication in error, please immediately notify the sender by telephone or e-mail and destroy the original message, attachments, and all copies.

On Jun 18, 2014 2:17 PM, Aaron Wasserott <aaron.wasserott-b+YE/***@public.gmane.org> wrote:
Some ISPs will still use PPP even though you have static assignments. This gives them an easy way to lock accounts for non-payment in their RADIUS server, instead of having to shut down the PVC or DSLAM interface.

From: wireshark-users-bounces-IZ8446WsY0/***@public.gmane.org [mailto:wireshark-users-***@wireshark.org] On Behalf Of Jamie O. Montgomery
Sent: Wednesday, June 18, 2014 11:59 AM
To: Community support list for Wireshark
Subject: Re: [Wireshark-users] Using Wireshark for a DSL "link no surf" problem

PPPoE is used for authentication. If you have a static IP, they know who has it and you don't need authentication. PPPoE would be the termination point for the address, but since it will reside on your firewall, the modem needs to bridge the dsl network to the Ethernet network on the public side if the firewall

They give you a /24 because they'd be burning up more IPv4 addresses giving you a smaller subnet. Other static IP customers use addresses in that subnet along with you.
Jamie Montgomery | Comporium
Network Facilities Engineering | Engineering Associate II
www.comporium.com<http://www.comporium.com/>
jamie.montgomery-***@public.gmane.org<mailto:jamie.montgomery-***@public.gmane.org>


The information contained in this e-mail message and any attachments thereto are confidential, privileged, or otherwise protected from disclosure, and are intended for the use of the individual or entity named above. Dissemination, distribution or copying of this message and any attachments by anyone other than the intended recipient, or an employee or agent responsible for delivering the message to the intended recipient, is prohibited. If you have received this communication in error, please immediately notify the sender by telephone or e-mail and destroy the original message, attachments, and all copies.

On Jun 18, 2014, at 1:34 PM, "Kok-Yong Tan" <ktan-Utl/FKD7rXpskJ3/***@public.gmane.org<mailto:ktan-Utl/FKD7rXpskJ3/***@public.gmane.org>> wrote:
No, the DSL modem is bridging, not routing. I've been assigned two static IPs (although they've given me a /24 net mask!!!) and my firewall is assigned one of them. The firewall is connected directly to the DSL modem by Cat6 patch cable. The other IP is unused (I use it for testing VPN configurations).

I'm not sure but since the Broadxent Briteport is a PPPoE modem, I assume PPPoE. But the tech says that's not correct (WTF?). And he can't explain what they use. Sigh.
--
Reality Artisans, Inc.
# Network Wrangling and Delousing
P.O. Box 565, Gracie Station
# Apple Certified Consultant
New York, NY 10028-0019
# Apple Consultants Network member
<http://www.realityartisans.com<http://www.realityartisans.com/>>
# Apple Developer Connection member
Cell: [phone]
# Ofc: [phone]

On Jun 17, 2014, at 22:13 , Pedro Tumusok <pedro.tumusok-***@public.gmane.org<mailto:pedro.tumusok-***@public.gmane.org>> wrote:


Well if the tech can see stuff, its not what I thought might be the problem, which was PVC settings.

But does your modem get an IP address, ie is it setup as a router or does your computer get the ip address?
Are you using PPPoA/PPPoE etc?

On Wed, Jun 18, 2014 at 5:52 AM, Frank Bulk <frnkblk-***@public.gmane.org<mailto:frnkblk-***@public.gmane.org>> wrote:
Some Comtrend modems can do a port mirror of the WAN (DSL) side.

Frank

-----Original Message-----
From: wireshark-users-bounces-IZ8446WsY0/***@public.gmane.org<mailto:wireshark-users-***@wireshark.org>
[mailto:wireshark-users-bounces-IZ8446WsY0/***@public.gmane.org<mailto:wireshark-users-***@wireshark.org>] On Behalf Of Kok-Yong Tan
Sent: Tuesday, June 17, 2014 4:53 PM
To: Community support list for Wireshark
Subject: Re: [Wireshark-users] Using Wireshark for a DSL "link no surf"
problem


> On Jun 17, 2014, at 14:28, Jaap Keuter <jaap.keuter-qWit8jRvyhVmR6Xm/***@public.gmane.org<mailto:jaap.keuter-qWit8jRvyhVmR6Xm/***@public.gmane.org>> wrote:
>
>> On 06/17/2014 08:42 PM, Kok-Yong Tan wrote:
>> Is it possible to use Wireshark to troubleshoot a DSL "link no surf"
problem? The ISP insists it's a CPE issue but the problem only started
after their Tier 1 tech monkeyed with the DSLAM and/or the CPE (remotely) in
some manner. I find it suspicious that the problem was intermittent packet
loss until they tinkered, whereupon the problem became a "link no surf"
issue (i.e., there's Layer 2 connectivity but zero Layer 3 traffic passing).
>
> Depends on what you can trace in the CPE, as in, how close to the DSL
interface.
> Otherwise you'll need capture hardware on the DSL....
>
> Good luck,
> Jaap
>

I can get up to the DSL modem itself. In hindsight, I'm thinking this isn't
going to be of much use and the only way to debug this is with capture
hardware on the DSL side as you suggested. Drat.
--
Sent from my iPad2 with greater chance of typographical, grammatical and
other disasters. Your indulgence is even more humbly requested.
___________________________________________________________________________
Sent via: Wireshark-users mailing list <wireshark-users-IZ8446WsY0/***@public.gmane.org<mailto:wireshark-users-IZ8446WsY0/***@public.gmane.org>>
Archives: http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
mailto:wireshark-users-request-IZ8446WsY0/***@public.gmane.org<mailto:wireshark-users-request-IZ8446WsY0/***@public.gmane.org>?subject=unsubscribe



--
Best regards / Mvh
Jan Pedro Tumusok
___________________________________________________________________________
Sent via: Wireshark-users mailing list <wireshark-users-IZ8446WsY0/***@public.gmane.org<mailto:wireshark-users-IZ8446WsY0/***@public.gmane.org>>
Archives: http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
mailto:wireshark-users-request-IZ8446WsY0/***@public.gmane.org?subject=unsubscribe

___________________________________________________________________________
Sent via: Wireshark-users mailing list <wireshark-users-IZ8446WsY0/***@public.gmane.org<mailto:wireshark-users-IZ8446WsY0/***@public.gmane.org>>
Archives: http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
mailto:wireshark-users-request-IZ8446WsY0/***@public.gmane.org?subject=unsubscribe

[Kok-Yong Tan]

As I expected, MegaPutz was at fault: They'd changed my VPI/VCI circuit
numbers out from under me, from 0/35 (the default) to 0/40 at the DSLAM.
This was proven when the technician showed up today with a brand new
ZyXEL P660R-F1 ATU-R (a.k.a. CPE or DSL modem) which allowed changes via
its webpage instead of some special piece of software only available to
OEMs. When he plugged it in, the ZyXEL P660R-F1 also wouldn't connect
with the default VPI/VCI of 0/35. But then he checked the configuration
with a software tool only available to MegaPutz technicians and noticed
that the idiots at the CO were sending data down 0/40 instead. Once he
reconfigured the P660R-F1 for a VPI/VCI of 0/40, my link-no-surf issue
instantly disappeared and my connection was back up again. Instantly.
No delay. Like there was no problem whatsoever. Total time spent? 15
minutes. That included the introductory conversational pleasantries.

And the worst of it? MegaPutz now wants to charge me multiple $$$ for a
"truck roll" plus the cost of the new modem despite having caused the
issue in the first place ("we need to charge any time we send a
technician out even if it's our fault and your modem is just old instead
of plain broken"). Even when all they'd had to do was to revert the
circuit to 0/35 instead of the 0/40 they had set it to (the VPI/VCI
numbers are virtual circuit numbers). A 2-minute job. Maybe 5-minutes
if they stopped to scratch their butts. If they knew what they were
doing, that was (they'd told me they escalated this trouble ticket to
Tier 2, NOC Operations and then the duty Network Engineer but everybody
just came back with "it's a broken CPE"). Something they should've
noticed when I sent them screenshots of the old Broadxent Briteport's
setup screens which prominently displayed the VPI/VCI as 0/35 and not
0/40 that they had set the DSLAM card to. And the only "upside" from my
being down for 11 days while out at Sharkfest? A measly $33 credit for
the problem they caused in the first place. Since they bought out
Speakeasy (which I was an original customer of and whose Tier 1 techs
were the equivalent of everybody else's Tier 3 techs), MegaPath's
constant cost cutting truly shows in the quality of their staff (their
field technicians are different because they're subcontractors so there
are good ones and bad ones).

#MegaPathSucks

On 6/18/14 17:25, Jamie O. Montgomery wrote:
> True. With the two types of DSLAMs we have we either associate the
> static IP with the port or the mac address of the CPE. The IP wouldn't
> work anywhere else.
>
> Jamie Montgomery | Comporium
> Network Facilities Engineering | Engineering Associate II
> www.comporium.com
> jamie.montgomery-***@public.gmane.org
>
> The information contained in this e-mail message and any attachments
> thereto are confidential, privileged, or otherwise protected from
> disclosure, and are intended for the use of the individual or entity
> named above. Dissemination, distribution or copying of this message and
> any attachments by anyone other than the intended recipient, or an
> employee or agent responsible for delivering the message to the intended
> recipient, is prohibited. If you have received this communication in
> error, please immediately notify the sender by telephone or e-mail and
> destroy the original message, attachments, and all copies.
>
> On Jun 18, 2014 2:17 PM, Aaron Wasserott <aaron.wasserott-b+YE/***@public.gmane.org>
> wrote:
>
> Some ISPs will still use PPP even though you have static assignments.
> This gives them an easy way to lock accounts for non-payment in their
> RADIUS server, instead of having to shut down the PVC or DSLAM interface.
>
> *From:*wireshark-users-bounces-IZ8446WsY0/***@public.gmane.org
> [mailto:wireshark-users-bounces-IZ8446WsY0/***@public.gmane.org] *On Behalf Of *Jamie O.
> Montgomery
> *Sent:* Wednesday, June 18, 2014 11:59 AM
> *To:* Community support list for Wireshark
> *Subject:* Re: [Wireshark-users] Using Wireshark for a DSL "link no
> surf" problem
>
> PPPoE is used for authentication. If you have a static IP, they know who
> has it and you don't need authentication. PPPoE would be the termination
> point for the address, but since it will reside on your firewall, the
> modem needs to bridge the dsl network to the Ethernet network on the
> public side if the firewall
>
> They give you a /24 because they'd be burning up more IPv4 addresses
> giving you a smaller subnet. Other static IP customers use addresses in
> that subnet along with you.
>
> *Jamie Montgomery | Comporium*
>
> Network Facilities Engineering | Engineering Associate II
>
> www.comporium.com <http://www.comporium.com/>
>
> jamie.montgomery-***@public.gmane.org <mailto:jamie.montgomery-***@public.gmane.org>
>
>
>
> /The information contained in this e-mail message and any attachments
> thereto are confidential, privileged, or otherwise protected from
> disclosure, and are intended for the use of the individual or entity
> named above. Dissemination, distribution or copying of this message and
> any attachments by anyone other than the intended recipient, or an
> employee or agent responsible for delivering the message to the intended
> recipient, is prohibited. If you have received this communication in
> error, please immediately notify the sender by telephone or e-mail and
> destroy the original message, attachments, and all copies./
>
>
> On Jun 18, 2014, at 1:34 PM, "Kok-Yong Tan" <ktan-Utl/FKD7rXpskJ3/***@public.gmane.org
> <mailto:ktan-Utl/FKD7rXpskJ3/***@public.gmane.org>> wrote:
>
> No, the DSL modem is bridging, not routing. I've been assigned two
> static IPs (although they've given me a /24 net mask!!!) and my
> firewall is assigned one of them. The firewall is connected
> directly to the DSL modem by Cat6 patch cable. The other IP is
> unused (I use it for testing VPN configurations).
>
> I'm not sure but since the Broadxent Briteport is a PPPoE modem, I
> assume PPPoE. But the tech says that's not correct (WTF?). And he
> can't explain what they use. Sigh.
>
> --
>
> Reality Artisans, Inc.
>
> # Network Wrangling and Delousing
> P.O. Box 565, Gracie Station
>
> # Apple Certified Consultant
> New York, NY 10028-0019
>
> # Apple Consultants Network member
> <http://www.realityartisans.com <http://www.realityartisans.com/>>
>
> # Apple Developer Connection member
>
> Cell: [phone]
>
> # Ofc: [phone]
>
> On Jun 17, 2014, at 22:13 , Pedro Tumusok <pedro.tumusok-***@public.gmane.org
> <mailto:pedro.tumusok-***@public.gmane.org>> wrote:
>
>
>
> Well if the tech can see stuff, its not what I thought might be the
> problem, which was PVC settings.
>
> But does your modem get an IP address, ie is it setup as a router or
> does your computer get the ip address?
>
> Are you using PPPoA/PPPoE etc?
>
> On Wed, Jun 18, 2014 at 5:52 AM, Frank Bulk <frnkblk-***@public.gmane.org
> <mailto:frnkblk-***@public.gmane.org>> wrote:
>
> Some Comtrend modems can do a port mirror of the WAN (DSL) side.
>
> Frank
>
>
> -----Original Message-----
> From: wireshark-users-bounces-IZ8446WsY0/***@public.gmane.org
> <mailto:wireshark-users-bounces-IZ8446WsY0/***@public.gmane.org>
> [mailto:wireshark-users-bounces-IZ8446WsY0/***@public.gmane.org
> <mailto:wireshark-users-bounces-IZ8446WsY0/***@public.gmane.org>] On Behalf Of
> Kok-Yong Tan
> Sent: Tuesday, June 17, 2014 4:53 PM
> To: Community support list for Wireshark
> Subject: Re: [Wireshark-users] Using Wireshark for a DSL "link no surf"
> problem
>
>
> > On Jun 17, 2014, at 14:28, Jaap Keuter <jaap.keuter-qWit8jRvyhVmR6Xm/***@public.gmane.org
> <mailto:jaap.keuter-qWit8jRvyhVmR6Xm/***@public.gmane.org>> wrote:
> >
> >> On 06/17/2014 08:42 PM, Kok-Yong Tan wrote:
> >> Is it possible to use Wireshark to troubleshoot a DSL "link no surf"
> problem? The ISP insists it's a CPE issue but the problem only started
> after their Tier 1 tech monkeyed with the DSLAM and/or the CPE
> (remotely) in
> some manner. I find it suspicious that the problem was intermittent
> packet
> loss until they tinkered, whereupon the problem became a "link no surf"
> issue (i.e., there's Layer 2 connectivity but zero Layer 3 traffic
> passing).
> >
> > Depends on what you can trace in the CPE, as in, how close to the DSL
> interface.
> > Otherwise you'll need capture hardware on the DSL....
> >
> > Good luck,
> > Jaap
> >
>
> I can get up to the DSL modem itself. In hindsight, I'm thinking
> this isn't
> going to be of much use and the only way to debug this is with capture
> hardware on the DSL side as you suggested. Drat.
> --
> Sent from my iPad2 with greater chance of typographical, grammatical and
> other disasters. Your indulgence is even more humbly requested.
>
> ___________________________________________________________________________
> Sent via: Wireshark-users mailing list
> <wireshark-users-IZ8446WsY0/***@public.gmane.org <mailto:wireshark-users-***@public.gmane.orgg>>
> Archives: http://www.wireshark.org/lists/wireshark-users
> Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
> mailto:wireshark-users-request-IZ8446WsY0/***@public.gmane.org
> <mailto:wireshark-users-request-IZ8446WsY0/***@public.gmane.org>?subject=unsubscribe
>
>
>
> --
> Best regards / Mvh
> Jan Pedro Tumusok
>
> ___________________________________________________________________________
> Sent via: Wireshark-users mailing list
> <wireshark-users-IZ8446WsY0/***@public.gmane.org <mailto:wireshark-users-***@public.gmane.orgg>>
> Archives: http://www.wireshark.org/lists/wireshark-users
> Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
> mailto:wireshark-users-request-IZ8446WsY0/***@public.gmane.org?subject=unsubscribe
>
> ___________________________________________________________________________
> Sent via: Wireshark-users mailing list
> <wireshark-users-IZ8446WsY0/***@public.gmane.org <mailto:wireshark-users-***@public.gmane.orgg>>
> Archives: http://www.wireshark.org/lists/wireshark-users
> Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
> mailto:wireshark-users-request-IZ8446WsY0/***@public.gmane.org?subject=unsubscribe
>
>
>
> ___________________________________________________________________________
> Sent via: Wireshark-users mailing list <wireshark-users-***@public.gmane.orgg>
> Archives: http://www.wireshark.org/lists/wireshark-users
> Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
> mailto:wireshark-users-request-IZ8446WsY0/***@public.gmane.org?subject=unsubscribe
>