Simple PPPoE scanner Python Script

[JB701]

I've created a very simple Python script for scanning PPPoE Servers, why? Because I can't find any on the internet other than this paid (with trial) software PPPoE services monitor

Make sure scapy module is installed using "pip install scapy"

This script isn't even remotely pretty but it works:

from scapy.all import *
from scapy.layers.ppp import *

iface="Realtek PCIe GbE Family Controller"

PADI = 0x09
PADO = 0x07
PADR = 0x19
PADS = 0x65
PADT = 0xa7

def sendPADI(smac="00:2B:67:F8:1F:78"):

    padi_discover = Ether(src=smac, dst="ff:ff:ff:ff:ff:ff", type=0x8863) / PPPoED(version=1, type=1, code=PADI,
                                                                                   sessionid=0x0,
                                                                                   )
    sendp(padi_discover, iface=iface)

def packet_callback(pkt):

    if pkt.haslayer(PPPoED):
        if pkt[PPPoED].code == PADO:
            for p in pkt:
                a=p.show(dump=True)
                print(a)
sendPADI()
sniff(filter="(pppoed or pppoes)", prn=packet_callback, store=0,iface=iface)

Make sure to change the iface variable to whatever interface is yours (NOTE: PPPoE Servers cannot be scanned on WiFi, use Ethernet). To get the interface name in Windows open cmd and type "ipconfig /all" and copy the Description of your Ethernet interface.

This will print the PPPoE Servers by sniffing for PADO Packets after sending a PADI Discover.

Sometimes the PADO Packet doesn't get sniffed so make sure to run the script a few times. I may make it fancier in the future.

 

[JB701]

Here is the script for scanning PPPoE Servers across all the possible VLANs (1-4094). Only works on Linux as Windows strips the VLAN Tag on most NICs.

from scapy.layers.l2 import *
from scapy.layers.ppp import *
PADI = 0x09
PADO = 0x07
PADR = 0x19
PADS = 0x65
PADT = 0xa7

iface = "eth0"

ether = Ether(dst="ff:ff:ff:ff:ff:ff")

def sendPADI(smac="00:2B:67:F8:1F:78"):
    for x in range(1,4094):
        padi_discover = ether/Dot1Q(vlan=x)/PPPoED(version=1, type=1, code=PADI,sessionid=0x0)
        sendp(padi_discover,iface=iface)

sendPADI()

No sniffing function on this one but you can just use "pppoe.code==0x07" filter on Wireshark.

 

[Trex]

What info can we get by scanning pppoe?

 

[JB701]

the service name and server mac address mainly.

certain isps may have multiple pppoe servers using same service name.

 

[Prashanth]

If I can see all available AC MAC address (using this method) , is there any way to get connection from specific AC ?

 

[JB701]

Routeros has the option to specify AC name.

 

---

[Prashanth]

Struck with archer c6 v2

 

[JB701]

I think openwrt mightve it too

Edit: yep it does WAN interface protocols

 

[Prashanth]

What If I call PPPoE from windows directly ?

 

[JB701]

Don't think it has that option. Service Name only