⚠️ Disclaimer: This guide is for educational and network troubleshooting purposes only. Do not capture or use credentials you don’t own or have permission to access. Unauthorized interception may violate laws in your country.
Why This Works
PPPoE supports two common authentication methods:
- PAP (Password Authentication Protocol) — sends credentials in plain text.
- CHAP (Challenge Handshake Authentication Protocol) — sends hashed credentials.
If the PPPoE server only allows PAP, then the username and password are visible to anyone who can sniff the PPPoE session.
OLT Stick
Plug your OLT Stick to any SFP slot
OLT Stick has fixed speed mode, by default 1Gb mode, there is 2.5Gb variant, you need disable auto nego and set
1G baseXor2.5G baseXrespectively
Host a temporary PAP-only PPPoE server on the target VLAN
Create Target VLAN
/interface vlan add interface=bridge name=vlan500 vlan-id=500Put on bridge interface effectively all port support it
Create PPPoE Server
/interface pppoe-server server add interface=vlan500 authentication=papYou do not need to add an account, just host a server is enough for GPON Router to respond
Capture
/tool sniffer set file-name=pppoe-login.pcap file-limit=1024 filter-interface=vlan500
/tool sniffer startWait a few second then stop
/tool sniffer stopDownload Capture
from the WinBox/WebFig, download pppoe-login.pcap to your Desktop for easy access
Wireshark
Make sure you have install and Wireshark ready, then open pppoe-login.pcap and look for PPP PAP
This effectively display PPPoE Username and Password in plain text because of PAP auth