PPPoE must die - Tech from 90s Holding Back Fibre Speeds

[Atomic Access]

Blog post about why Atomic does not use PPPoE​

PPPoE Must Die - 80s tech holding back fibre speeds

Update 12 December 2025: Octotel recently launched XGS-PON FTTH services with 2.5Gbps+ speeds. PPP is clearly not well-suited for the XGS-PON use case. Here is a speed test we did on an Octotel 2.5Gbps link at Playtopia showing 2224Mbps (the expected maximum speed is approximately 2350 Mbps)...

www.atomic.co.za

 

[Xtm]

Openserve AKA telkom still uses PPPoE like old dsl days.

 

[EmmanuelGoldstein]

Blog post about why Atomic does not use PPPoE​

PPPoE Must Die - 80s tech holding back fibre speeds

Update 12 December 2025: Octotel recently launched XGS-PON FTTH services with 2.5Gbps+ speeds. PPP is clearly not well-suited for the XGS-PON use case. Here is a speed test we did on an Octotel 2.5Gbps link at Playtopia showing 2224Mbps (the expected maximum speed is approximately 2350 Mbps)...

www.atomic.co.za

Unfortunately there’s an awful lot of GPON out there…
If it works, it works.. as it does for me.
Your company isn’t as good as you think you are either so a bit of the pot calling the kettle black I detect?

 

[cavedog]

It becomes very hard to find positives once you do DHCP at scale.

 

[William1102]

DHCP is terrible ever since recently it has been causing drops each lasting 5-10 minutes, almost every other day I sit through buffering and getting kicked off games due to the disconnections. Neighbors have no issues on the same FNO

 

[repitah]

I remember being with an ISP when I first got fibre and was still cancelling my ADSL. I bungled my network up spectacularly and had the users on fibre sucking the DSL line dead, because I was their DHCP and became the ISP. Apart from lessons learnt to not try be clever-while-tired and actually draw out my network before messing with all the wires to seperate private from public (I don't yet have VLAN switches at home but on my wishlist), the thing about DHCP based was the lack of auto login by the router

Perhaps things have changed in the years.

My wishlist

• FNOs have DHCP snooping/guard on the consumer ports and/or L2 separation just in case a consumer does miswire (or attack; see concerns)
• Method to auto login
  • EG: Your area has a power outage for an hour while away from home and your DHCP session expired. Power is back, but nothing works until you get home. The "SMART" devices will have a bad time. The kids/olders/neighbours/pirates will be unhappy. You can't access your cameras / alarm / dishwasher / washing machine / coffee machine / aurconditioning. You need to get home and connect to the wifi, which most end users have now rebooted 16 times anyways, just to sign in an activate the connection.
  • When ISPs start actually doing IPv6, this will also become interesting. IPv6 NAT? IPv4 sure, really simple and any captive portal can do that.

My concerns

• L2 speration at FNO switch/aggregator level
• I wonder how that would play out if I set my WAN port to have a spoofed MAC address.
  • ok, so most consumers will just take whatever router the ISP lumps them with, but open/alterntive firmwares exist for those that select the "Just gimme the no frills ONT, please" option.
• Being stuck with a horrid router because the ISP/FNO will only allow their router, setup by them, TR69/autoconfiged with some lousy settings, no port forwarding, no SQM/QoS.
  • Oh your youtube sucks because the varsity kid is on their notebook torrenting live stream series and sucking priority and bandwidth dead while chatting on discord, so sorry, please upgrade to our Pro Max Ultra Giga package.
    • Yes you could scream at the kid, but then the puss-in-boots teary wide eyes happen because they just must...
    • Discovering bufferbloat testing and easy guides for OpnSense/pfSense/OpenWRT brings sanity to such households.

The article notes why PPPoE sucks: encapsulation. The lethargic barely gigahertz processor on that nasty AF router from the ISP obviously won't cut the mustard. Not saying some of the routers aren't actually fairly decent, but even those fancy routers with more antenna than an octopus holding 90's TV aerials, actually warn you that switching QoS on may hurt your throughput (because that isn't offloaded to the ASIC). To do gigabit speeds with encapuslation and other tricks, you need fast horses carrying a set of science prize winners, not a mule carrying a bus of day labourers.

 

[HartsockZA]

It becomes very hard to find positives once you do DHCP at scale.

Yip, said the same thing. I actually asked someone if IPV6 was the answer and apparently not as yet.

 

[Nuke]

Yeah, nope.

I see your 8 byte PPPOE header and raise you a 8 byte QinQ header used in enterprise WANs all over.

 

[SwimGeek]

Unfortunately there’s an awful lot of GPON out there…
If it works, it works.. as it does for me.
Your company isn’t as good as you think you are either so a bit of the pot calling the kettle black I detect?

Not sure how GPON is relevant.

 

[Packet-Kollector]

DHCP is terrible ever since recently it has been causing drops each lasting 5-10 minutes, almost every other day I sit through buffering and getting kicked off games due to the disconnections. Neighbors have no issues on the same FNO

Your FNO doesnt know what they are doing, lemme guess which one it is....

 

[Packet-Kollector]

Unfortunately there’s an awful lot of GPON out there…
If it works, it works.. as it does for me.
Your company isn’t as good as you think you are either so a bit of the pot calling the kettle black I detect?

I too, fish with the red sky beer drink. Table? Motorcycle.

 

[Atomic Access]

It becomes very hard to find positives once you do DHCP at scale.

Verizon Fios seems to get it right at scale - that's a pretty big network.

Even if handing out IPs is a bit more complex for the ISP to manage, it's better to optimise for the end user's experience.

 

[cavedog]

Verizon Fios seems to get it right at scale - that's a pretty big network.

Even if handing out IPs is a bit more complex for the ISP to manage, it's better to optimise for the end user's experience.

Yes but that is when you have control over the entire network. In SA you don't.

In SA we have FNO's with so many mixed vendors all with their own L2 security systems. They have plenty of vlans, leafs and spines and offer a mix of different type of services. Couple that lack of proper L2 client isolation its a recipe for disaster.

At Afrihost we pretty much know that disaster on a daily basis. In fact so well that troubleshooting dhcp related issues has become a daily task.

Rogue dhcp servers, printers eating up address space. Cancelled clients sending broadcast storms to us. Incorrectly configured storm protection breaking dhcpv6, certain fno vendors not even supporting dhcpv6 and the list goes on. It's tiring and at one point which has already happened with an FNO they simply say switch to PPP because we can't guarantee service if you stay on DHCP and there is NOTHING we can do for you yet the issues are on their L2.

So yes, in a perfect world DHCP would be best but in SA the way it is, it's not.

 

[cavedog]

Yeah, nope.

I see your 8 byte PPPOE header and raise you a 8 byte QinQ header used in enterprise WANs all over.

Cough cough "reflex solutions" with all their sub FNO's and supported ISPs.

 

[Atomic Access]

Yes but that is when you have control over the entire network. In SA you don't.

In SA we have FNO's with so many mixed vendors all with their own L2 security systems. They have plenty of vlans, leafs and spines and offer a mix of different type of services. Couple that lack of proper L2 client isolation its a recipe for disaster.

At Afrihost we pretty much know that disaster on a daily basis. In fact so well that troubleshooting dhcp related issues has become a daily task.

Rogue dhcp servers, printers eating up address space. Cancelled clients sending broadcast storms to us. Incorrectly configured storm protection breaking dhcpv6, certain fno vendors not even supporting dhcpv6 and the list goes on. It's tiring and at one point which has already happened with an FNO they simply say switch to PPP because we can't guarantee service if you stay on DHCP and there is NOTHING we can do for you yet the issues are on their L2.

So yes, in a perfect world DHCP would be best but in SA the way it is, it's not.

Atomic is only connected to 4 FNOs - they seem to get it right, including IPv6 support.

 

[cavedog]

Atomic is only connected to 4 FNOs - they seem to get it right, including IPv6 support.

Hmmm. Vumatel if that includes the old SADV I doubt that. Calix mac forced forwarding which is a feature that you really need on your vlan to prevent rogue dhcp blackholes icmpv6 on high traffic OLTs. We see this with MetroFibre and ohh Frogfoot. MetroFibre Nokia doesn't support dhcpv6 or not at least the way Metro rolls it out.

Also we had evpn blacklisting our gateway mac many times on Vuma Villages due to loops. Also DHCP related because the gateway mac is cloned by a subscriber and learned on a port channel its not supposed to which triggers the loop protection.

So far the only FNO that can get thing right is Octotel.

 

[repitah]

Verizon Fios seems to get it right at scale - that's a pretty big network.

Even if handing out IPs is a bit more complex for the ISP to manage, it's better to optimise for the end user's experience.

Forgive my lack of knowledge or experience on PON, but do the ISPs get the ONT serial number, or is that an FNO only thing (OLT to ethernet and FNO drops that detail in transit to ISP)?

I'm sure that DHCP scales easily and well -- easy and proven, even quite powerful. Also, that means the ASIC/network acceleration can work on the fairly low power routers to achieve the gigabit+ forwarding speeds. The support team may even have an easier time instead of having to walk customers through initial setups or factory resetting routers and having the myriad of interfaces to figure out.

I still get hung up on the captive portal authentication I've seen ISPs use: PPPoE is set and forget or go find the details in the password manager or email from years ago. The moment the ISP can ask to confirm the ONT serial, click, click, 1 minute later DHCP request gets DHCP offer and data just flows without intervention, I'll be happy.

Once the serial of the fibre ONT is the authentication method instead of a captive portal, I wouldn't mind DHCP much. The biggest struggle would be replacing the ONT for whatever reason, and calling[/logging client portal ticket] the ISP to say new serial number.

 

[repitah]

Yes but that is when you have control over the entire network. In SA you don't.

In SA we have FNO's with so many mixed vendors all with their own L2 security systems. They have plenty of vlans, leafs and spines and offer a mix of different type of services. Couple that lack of proper L2 client isolation its a recipe for disaster.

At Afrihost we pretty much know that disaster on a daily basis. In fact so well that troubleshooting dhcp related issues has become a daily task.

Rogue dhcp servers, printers eating up address space. Cancelled clients sending broadcast storms to us. Incorrectly configured storm protection breaking dhcpv6, certain fno vendors not even supporting dhcpv6 and the list goes on. It's tiring and at one point which has already happened with an FNO they simply say switch to PPP because we can't guarantee service if you stay on DHCP and there is NOTHING we can do for you yet the issues are on their L2.

So yes, in a perfect world DHCP would be best but in SA the way it is, it's not.

Ah yes... the rogue DHCP server...
DHCP snooping is not being implemented then.

I used to scream when I took on a campus network and malakas plug in random stuff...tick tock minutes pass...next thing sales or accounts or even factory is dead and the MD is hovering around making you feel inadequate.

I'm sure raging customers make the call center / support people feel just the same.

 

[Packet-Kollector]

Hmmm. Vumatel if that includes the old SADV I doubt that. Calix mac forced forwarding which is a feature that you really need on your vlan to prevent rogue dhcp blackholes icmpv6 on high traffic OLTs. We see this with MetroFibre and ohh Frogfoot. MetroFibre Nokia doesn't support dhcpv6 or not at least the way Metro rolls it out.

Also we had evpn blacklisting our gateway mac many times on Vuma Villages due to loops. Also DHCP related because the gateway mac is cloned by a subscriber and learned on a port channel its not supposed to which triggers the loop protection.

So far the only FNO that can get thing right is Octotel.

Why not tell them to come to the table and better their networks, with your guidance if you know whats needed?
Why onboard an FNO if it totally wrecks your network policies and design? You're big enough to say "Hey if you cant build your network right we are likely to rethink connecting with you".
You're meant to advocate for your clients, and if you cant meet your promises to your clients based on the FNO, the buck essentially would stop with you when it breaks (Which I am sure you experienced already, maybe)

 

[Atomic Access]

Forgive my lack of knowledge or experience on PON, but do the ISPs get the ONT serial number, or is that an FNO only thing (OLT to ethernet and FNO drops that detail in transit to ISP)?

I'm sure that DHCP scales easily and well -- easy and proven, even quite powerful. Also, that means the ASIC/network acceleration can work on the fairly low power routers to achieve the gigabit+ forwarding speeds. The support team may even have an easier time instead of having to walk customers through initial setups or factory resetting routers and having the myriad of interfaces to figure out.

I still get hung up on the captive portal authentication I've seen ISPs use: PPPoE is set and forget or go find the details in the password manager or email from years ago. The moment the ISP can ask to confirm the ONT serial, click, click, 1 minute later DHCP request gets DHCP offer and data just flows without intervention, I'll be happy.

Once the serial of the fibre ONT is the authentication method instead of a captive portal, I wouldn't mind DHCP much. The biggest struggle would be replacing the ONT for whatever reason, and calling[/logging client portal ticket] the ISP to say new serial number.

Hi

We don't use captive portals. We do sometimes use the MAC of the customer router to configure a static IP.

We rely on the FNO to configure DHCP Option82 correctly, which gives us the line-id.

The ISP can get the ONT serial, but we don't use it that often - more of an admin thing - reconnect and migration process.