Cisco Support Community
Showing results for 
Search instead for 
Did you mean: 

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. If you'd prefer to explore, try our test area to get started. And see here for current known issues.

New Member

PPPoed capture on PIX

I've looked all over the Cisco site to find out what this actual capture pppoed output I collected actually means. Any help? I can guess, I just need detail. Tried importing to ethereal with no luck.

13:19:08.924970 0002.b309.95cb 000e.a619.1502 0x0800 1434: > . 2473143978:2473145358(1380) ack 3662812289 win 6930 (DF) (

ttl 62, id 63664)

13:19:08.925565 00d0.bcf2.701c 0002.b309.95cb 0x0800 60: > 20 . [tcp sum ok] 3662812289:3662812289(0) ack 2473145358 win 655

35 (DF) (ttl 127, id 15997)

13:19:08.932492 0002.b309.95cb 000e.a619.1502 0x0800 1434: > . 2473145358:2473146738(1380) ack 3662812289 win 6930 (DF) (

ttl 62, id 63665)


Re: PPPoed capture on PIX

Just looks like ordinary network traffic to me. I don't see anything "pppoe" about that trace.

New Member

Re: PPPoed capture on PIX

Yes, I just want a decriptor for each thing. Not the IP's of course.


Re: PPPoed capture on PIX

Ok, I'll take a stab at it:

13:19:08.924970 - Really long timestamp

0002.b309.95cb 000e.a619.1502 - Source and destination mac addresses

0x0800 1434: - not sure > - Source IP and port - Destination IP and port

. 2473143978:2473145358(1380) - MSS (Maximum Segment Size) I think

ack 3662812289 win 6930 - TCP ack # and window size

(DF) - "Do not fragment" bit is set

(ttl 62, id 63664) - Time to Live and some id #

HTH pls rate!